xmrig | 4380a4b9a183ea3ac83457f0a0aa4b7b66aaf72d9a82dc90e5ac5979cd1de635

Analysis

max time kernel
33s
max time network
30s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
Size

1.9MB
MD5

071f9161f87630cd090f45d7796250b8
SHA1

4e2d4cc9b77795e2061a093d5f0882ee91c03914
SHA256

4380a4b9a183ea3ac83457f0a0aa4b7b66aaf72d9a82dc90e5ac5979cd1de635
SHA512

4457434f31a2f6ff1291c42f871194ca04e869d863c3b6fe0243965897b05c39881a98b2d57af6ea1b4cf2b124ff67678acead0a13e2bebf04eb8b80c5d0f508
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1Z:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2640-18-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2456-39-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/3020-431-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2864-80-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2880-77-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2540-74-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2532-48-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/3068-38-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2364-35-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/3068-613-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2640-1109-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3020	rodbaFl.exe
2640	QNkTtkP.exe
2364	ADbkPad.exe
2456	uzJZocr.exe
2532	muTaNxm.exe
2452	DGencBX.exe
2540	ldVLCIO.exe
2880	bbNzhTk.exe
2864	PmbeswS.exe
1760	loEnqPA.exe
2396	ryHKTiJ.exe
2600	CQefmdg.exe
2132	UfCooEf.exe
2352	cKSfjXv.exe
2312	GDDMaKm.exe
2340	FyfXyNd.exe
848	BJZIpOu.exe
2848	mJsMmau.exe
1928	HGdPMhQ.exe
2232	fnZYirS.exe
3052	udJsahr.exe
988	rZjyYCd.exe
1408	cXqCfen.exe
632	iLINWHr.exe
2012	ZrpJSfh.exe
2388	bKwlgJD.exe
2932	zitgNmO.exe
1536	FCxawBy.exe
352	HpxnsBa.exe
976	UxWWFbg.exe
312	UzgNQml.exe
908	ZHdqgsC.exe
1728	RfkByWZ.exe
1748	MygJgvs.exe
2804	SxrMuYQ.exe
288	WbgBmxk.exe
1316	cSCuGVS.exe
1436	vbGlDRI.exe
1852	KYYespn.exe
2276	rRjZebE.exe
2620	oVtoDqY.exe
2580	tosgRGl.exe
2420	wDVOfUj.exe
2308	RuudfyO.exe
1624	wLqdrCw.exe
2648	eqQmMWa.exe
1336	PAgFoXV.exe
1864	IMhJtNq.exe
2148	MPOBOhC.exe
1600	ceGFtYS.exe
2044	yYNSbIg.exe
2028	DIBKqQJ.exe
2644	RapuuSk.exe
2020	Jugpvww.exe
1736	HsuwOUE.exe
776	NSWCyEW.exe
2808	IBYeLIS.exe
980	aFnQumF.exe
912	ldeaVKt.exe
832	lahRbUa.exe
696	tAqLEHl.exe
1648	aqzJGMY.exe
1272	hvkgGmK.exe
1304	zePAfix.exe

Loads dropped DLL 64 IoCs

pid	Process
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3068-1-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x000c000000013f2c-6.dat	upx
behavioral1/files/0x003500000001432f-16.dat	upx
behavioral1/memory/2640-18-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/3020-12-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x0016000000005586-15.dat	upx
behavioral1/files/0x00080000000144f9-31.dat	upx
behavioral1/memory/2456-39-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/files/0x000700000001459d-44.dat	upx
behavioral1/files/0x0008000000014677-49.dat	upx
behavioral1/memory/2452-62-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x000600000001565a-61.dat	upx
behavioral1/files/0x0006000000015b50-92.dat	upx
behavioral1/files/0x0035000000014367-106.dat	upx
behavioral1/files/0x0006000000015d21-134.dat	upx
behavioral1/files/0x00060000000161ee-169.dat	upx
behavioral1/files/0x00060000000167bf-183.dat	upx
behavioral1/files/0x0007000000015083-56.dat	upx
behavioral1/files/0x0006000000015662-79.dat	upx
behavioral1/files/0x0006000000016575-178.dat	upx
behavioral1/files/0x00060000000163eb-171.dat	upx
behavioral1/memory/3020-431-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x0006000000016122-164.dat	upx
behavioral1/files/0x0006000000015fa6-157.dat	upx
behavioral1/files/0x0006000000015d9c-150.dat	upx
behavioral1/files/0x0006000000015d61-143.dat	upx
behavioral1/files/0x0006000000015d39-136.dat	upx
behavioral1/files/0x0006000000015d0a-129.dat	upx
behavioral1/files/0x0006000000015cee-122.dat	upx
behavioral1/files/0x0006000000015cd2-115.dat	upx
behavioral1/files/0x0006000000015cb1-108.dat	upx
behavioral1/files/0x0006000000015ca8-101.dat	upx
behavioral1/files/0x0006000000015b85-94.dat	upx
behavioral1/files/0x0006000000015ae3-85.dat	upx
behavioral1/memory/2864-80-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/files/0x0008000000014700-60.dat	upx
behavioral1/memory/2880-77-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2540-74-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/files/0x00060000000164ec-176.dat	upx
behavioral1/files/0x0006000000016013-162.dat	upx
behavioral1/files/0x0006000000015f23-155.dat	upx
behavioral1/files/0x0006000000015d85-148.dat	upx
behavioral1/files/0x0006000000015d59-141.dat	upx
behavioral1/files/0x0006000000015cf8-127.dat	upx
behavioral1/files/0x0006000000015ce3-120.dat	upx
behavioral1/files/0x0006000000015cc5-113.dat	upx
behavioral1/files/0x0006000000015c9a-99.dat	upx
behavioral1/files/0x00060000000158d9-84.dat	upx
behavioral1/memory/2532-48-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2364-35-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/3068-613-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/2640-1109-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pZXEVmM.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\oPoNGLS.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\BCmsMyG.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\QphdsYi.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\LXutHQv.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\VxlTRqz.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\DVTTFSk.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\MqysgHm.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\DKiDMuZ.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\yoDSCsl.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\FyfXyNd.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\lpHRwCb.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\CitpQuw.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\PiKCHOb.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\oiOeCWH.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\DeLOFnQ.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\bisHPSH.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\PjQoZRb.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\SnYBEcR.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\VRTmnwO.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\Ecmxcmn.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\ipzZBfi.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\gpiIfPI.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\HAZMrMi.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\NlXfGvj.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\zpqQJDg.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\nkKhYcb.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\VuIjhkC.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\dskbuLp.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\RybnSRM.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\BboDCBP.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\NBzupkU.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\demdIUH.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\oFhdfOG.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\hHYTKmz.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\gumNzcT.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\MoQBvly.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\DowyhKe.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\BNGxYPv.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\FShtyID.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\qpDxopT.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\LfRPdCM.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\BXaLUzh.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\ppGJNLr.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\KStvBSh.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\CxBDbEj.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\dtlXfaL.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\PNywQSl.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\UeTBEDT.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\XrDUIOU.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\wcCDzIC.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\cxSMIJm.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\DczacfW.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\hvkgGmK.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\vCsqFih.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\IaWWhJT.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\rbAevFz.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\uCsprPl.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\yUBirze.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\KBbcjnd.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\hwLIxUN.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\aLqxZBh.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\rmHPxIE.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
File created	C:\Windows\System\egjNgui.exe	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2604	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
Token: SeDebugPrivilege	2604	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2604	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	29
PID 3068 wrote to memory of 2604	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	29
PID 3068 wrote to memory of 2604	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	29
PID 3068 wrote to memory of 3020	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	30
PID 3068 wrote to memory of 3020	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	30
PID 3068 wrote to memory of 3020	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	30
PID 3068 wrote to memory of 2640	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	31
PID 3068 wrote to memory of 2640	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	31
PID 3068 wrote to memory of 2640	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	31
PID 3068 wrote to memory of 2364	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	32
PID 3068 wrote to memory of 2364	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	32
PID 3068 wrote to memory of 2364	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	32
PID 3068 wrote to memory of 2456	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	33
PID 3068 wrote to memory of 2456	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	33
PID 3068 wrote to memory of 2456	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	33
PID 3068 wrote to memory of 2532	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	34
PID 3068 wrote to memory of 2532	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	34
PID 3068 wrote to memory of 2532	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	34
PID 3068 wrote to memory of 2452	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	35
PID 3068 wrote to memory of 2452	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	35
PID 3068 wrote to memory of 2452	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	35
PID 3068 wrote to memory of 2540	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	36
PID 3068 wrote to memory of 2540	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	36
PID 3068 wrote to memory of 2540	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	36
PID 3068 wrote to memory of 2864	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	37
PID 3068 wrote to memory of 2864	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	37
PID 3068 wrote to memory of 2864	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	37
PID 3068 wrote to memory of 2880	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	38
PID 3068 wrote to memory of 2880	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	38
PID 3068 wrote to memory of 2880	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	38
PID 3068 wrote to memory of 1760	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	39
PID 3068 wrote to memory of 1760	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	39
PID 3068 wrote to memory of 1760	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	39
PID 3068 wrote to memory of 2396	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	40
PID 3068 wrote to memory of 2396	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	40
PID 3068 wrote to memory of 2396	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	40
PID 3068 wrote to memory of 2648	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	41
PID 3068 wrote to memory of 2648	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	41
PID 3068 wrote to memory of 2648	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	41
PID 3068 wrote to memory of 2600	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	42
PID 3068 wrote to memory of 2600	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	42
PID 3068 wrote to memory of 2600	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	42
PID 3068 wrote to memory of 1336	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	43
PID 3068 wrote to memory of 1336	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	43
PID 3068 wrote to memory of 1336	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	43
PID 3068 wrote to memory of 2132	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	44
PID 3068 wrote to memory of 2132	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	44
PID 3068 wrote to memory of 2132	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	44
PID 3068 wrote to memory of 1864	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	45
PID 3068 wrote to memory of 1864	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	45
PID 3068 wrote to memory of 1864	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	45
PID 3068 wrote to memory of 2352	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	46
PID 3068 wrote to memory of 2352	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	46
PID 3068 wrote to memory of 2352	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	46
PID 3068 wrote to memory of 2148	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	47
PID 3068 wrote to memory of 2148	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	47
PID 3068 wrote to memory of 2148	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	47
PID 3068 wrote to memory of 2312	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	48
PID 3068 wrote to memory of 2312	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	48
PID 3068 wrote to memory of 2312	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	48
PID 3068 wrote to memory of 1600	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	49
PID 3068 wrote to memory of 1600	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	49
PID 3068 wrote to memory of 1600	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	49
PID 3068 wrote to memory of 2340	3068	071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\071f9161f87630cd090f45d7796250b8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- C:\Windows\System\rodbaFl.exe
  C:\Windows\System\rodbaFl.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\QNkTtkP.exe
  C:\Windows\System\QNkTtkP.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\ADbkPad.exe
  C:\Windows\System\ADbkPad.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\uzJZocr.exe
  C:\Windows\System\uzJZocr.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\muTaNxm.exe
  C:\Windows\System\muTaNxm.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\DGencBX.exe
  C:\Windows\System\DGencBX.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\ldVLCIO.exe
  C:\Windows\System\ldVLCIO.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\PmbeswS.exe
  C:\Windows\System\PmbeswS.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\bbNzhTk.exe
  C:\Windows\System\bbNzhTk.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\loEnqPA.exe
  C:\Windows\System\loEnqPA.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ryHKTiJ.exe
  C:\Windows\System\ryHKTiJ.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\eqQmMWa.exe
  C:\Windows\System\eqQmMWa.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\CQefmdg.exe
  C:\Windows\System\CQefmdg.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\PAgFoXV.exe
  C:\Windows\System\PAgFoXV.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\UfCooEf.exe
  C:\Windows\System\UfCooEf.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\IMhJtNq.exe
  C:\Windows\System\IMhJtNq.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\cKSfjXv.exe
  C:\Windows\System\cKSfjXv.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\MPOBOhC.exe
  C:\Windows\System\MPOBOhC.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\GDDMaKm.exe
  C:\Windows\System\GDDMaKm.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ceGFtYS.exe
  C:\Windows\System\ceGFtYS.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\FyfXyNd.exe
  C:\Windows\System\FyfXyNd.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\yYNSbIg.exe
  C:\Windows\System\yYNSbIg.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\BJZIpOu.exe
  C:\Windows\System\BJZIpOu.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\DIBKqQJ.exe
  C:\Windows\System\DIBKqQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\mJsMmau.exe
  C:\Windows\System\mJsMmau.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\RapuuSk.exe
  C:\Windows\System\RapuuSk.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\HGdPMhQ.exe
  C:\Windows\System\HGdPMhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\Jugpvww.exe
  C:\Windows\System\Jugpvww.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\fnZYirS.exe
  C:\Windows\System\fnZYirS.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\HsuwOUE.exe
  C:\Windows\System\HsuwOUE.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\udJsahr.exe
  C:\Windows\System\udJsahr.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\NSWCyEW.exe
  C:\Windows\System\NSWCyEW.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\rZjyYCd.exe
  C:\Windows\System\rZjyYCd.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\IBYeLIS.exe
  C:\Windows\System\IBYeLIS.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\cXqCfen.exe
  C:\Windows\System\cXqCfen.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\aFnQumF.exe
  C:\Windows\System\aFnQumF.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\iLINWHr.exe
  C:\Windows\System\iLINWHr.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\ldeaVKt.exe
  C:\Windows\System\ldeaVKt.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\ZrpJSfh.exe
  C:\Windows\System\ZrpJSfh.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\lahRbUa.exe
  C:\Windows\System\lahRbUa.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\bKwlgJD.exe
  C:\Windows\System\bKwlgJD.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\tAqLEHl.exe
  C:\Windows\System\tAqLEHl.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\zitgNmO.exe
  C:\Windows\System\zitgNmO.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\aqzJGMY.exe
  C:\Windows\System\aqzJGMY.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\FCxawBy.exe
  C:\Windows\System\FCxawBy.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\hvkgGmK.exe
  C:\Windows\System\hvkgGmK.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\HpxnsBa.exe
  C:\Windows\System\HpxnsBa.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\zePAfix.exe
  C:\Windows\System\zePAfix.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\UxWWFbg.exe
  C:\Windows\System\UxWWFbg.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\MhmiOXN.exe
  C:\Windows\System\MhmiOXN.exe
  2⤵
  PID:820
- C:\Windows\System\UzgNQml.exe
  C:\Windows\System\UzgNQml.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\Zjzlpdn.exe
  C:\Windows\System\Zjzlpdn.exe
  2⤵
  PID:556
- C:\Windows\System\ZHdqgsC.exe
  C:\Windows\System\ZHdqgsC.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\DBupBnE.exe
  C:\Windows\System\DBupBnE.exe
  2⤵
  PID:872
- C:\Windows\System\RfkByWZ.exe
  C:\Windows\System\RfkByWZ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\CzAjeeV.exe
  C:\Windows\System\CzAjeeV.exe
  2⤵
  PID:3056
- C:\Windows\System\MygJgvs.exe
  C:\Windows\System\MygJgvs.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\kZudQNE.exe
  C:\Windows\System\kZudQNE.exe
  2⤵
  PID:2828
- C:\Windows\System\SxrMuYQ.exe
  C:\Windows\System\SxrMuYQ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\rtgYApB.exe
  C:\Windows\System\rtgYApB.exe
  2⤵
  PID:2836
- C:\Windows\System\WbgBmxk.exe
  C:\Windows\System\WbgBmxk.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\AEcVdsh.exe
  C:\Windows\System\AEcVdsh.exe
  2⤵
  PID:572
- C:\Windows\System\cSCuGVS.exe
  C:\Windows\System\cSCuGVS.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\EgoBphd.exe
  C:\Windows\System\EgoBphd.exe
  2⤵
  PID:1972
- C:\Windows\System\vbGlDRI.exe
  C:\Windows\System\vbGlDRI.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\JCOfyKW.exe
  C:\Windows\System\JCOfyKW.exe
  2⤵
  PID:1732
- C:\Windows\System\KYYespn.exe
  C:\Windows\System\KYYespn.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\igJHBdS.exe
  C:\Windows\System\igJHBdS.exe
  2⤵
  PID:1528
- C:\Windows\System\rRjZebE.exe
  C:\Windows\System\rRjZebE.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\ammzpNm.exe
  C:\Windows\System\ammzpNm.exe
  2⤵
  PID:2896
- C:\Windows\System\oVtoDqY.exe
  C:\Windows\System\oVtoDqY.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\nrzDvZx.exe
  C:\Windows\System\nrzDvZx.exe
  2⤵
  PID:2576
- C:\Windows\System\tosgRGl.exe
  C:\Windows\System\tosgRGl.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\ZPTmXKI.exe
  C:\Windows\System\ZPTmXKI.exe
  2⤵
  PID:2748
- C:\Windows\System\wDVOfUj.exe
  C:\Windows\System\wDVOfUj.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\EDhvNrP.exe
  C:\Windows\System\EDhvNrP.exe
  2⤵
  PID:2524
- C:\Windows\System\RuudfyO.exe
  C:\Windows\System\RuudfyO.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\Hpltvsd.exe
  C:\Windows\System\Hpltvsd.exe
  2⤵
  PID:300
- C:\Windows\System\wLqdrCw.exe
  C:\Windows\System\wLqdrCw.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\dDJRunf.exe
  C:\Windows\System\dDJRunf.exe
  2⤵
  PID:1752
- C:\Windows\System\ZXYHHDC.exe
  C:\Windows\System\ZXYHHDC.exe
  2⤵
  PID:1704
- C:\Windows\System\faDjoCn.exe
  C:\Windows\System\faDjoCn.exe
  2⤵
  PID:2852
- C:\Windows\System\VxlTRqz.exe
  C:\Windows\System\VxlTRqz.exe
  2⤵
  PID:336
- C:\Windows\System\zwtzwWX.exe
  C:\Windows\System\zwtzwWX.exe
  2⤵
  PID:1788
- C:\Windows\System\sLVjUyZ.exe
  C:\Windows\System\sLVjUyZ.exe
  2⤵
  PID:448
- C:\Windows\System\VKJvLbj.exe
  C:\Windows\System\VKJvLbj.exe
  2⤵
  PID:2796
- C:\Windows\System\GMbIeQv.exe
  C:\Windows\System\GMbIeQv.exe
  2⤵
  PID:756
- C:\Windows\System\GMZUDXx.exe
  C:\Windows\System\GMZUDXx.exe
  2⤵
  PID:3016
- C:\Windows\System\psCSiAH.exe
  C:\Windows\System\psCSiAH.exe
  2⤵
  PID:1668
- C:\Windows\System\YtxpZOb.exe
  C:\Windows\System\YtxpZOb.exe
  2⤵
  PID:876
- C:\Windows\System\cbwnbrN.exe
  C:\Windows\System\cbwnbrN.exe
  2⤵
  PID:1500
- C:\Windows\System\YCMVsdZ.exe
  C:\Windows\System\YCMVsdZ.exe
  2⤵
  PID:2444
- C:\Windows\System\FLAVYYB.exe
  C:\Windows\System\FLAVYYB.exe
  2⤵
  PID:2924
- C:\Windows\System\AkZHtpE.exe
  C:\Windows\System\AkZHtpE.exe
  2⤵
  PID:1428
- C:\Windows\System\mAzSkXL.exe
  C:\Windows\System\mAzSkXL.exe
  2⤵
  PID:2708
- C:\Windows\System\QnznAQE.exe
  C:\Windows\System\QnznAQE.exe
  2⤵
  PID:3036
- C:\Windows\System\iiUqJaF.exe
  C:\Windows\System\iiUqJaF.exe
  2⤵
  PID:688
- C:\Windows\System\YxaYMCf.exe
  C:\Windows\System\YxaYMCf.exe
  2⤵
  PID:3084
- C:\Windows\System\BsMjUma.exe
  C:\Windows\System\BsMjUma.exe
  2⤵
  PID:3100
- C:\Windows\System\JxrLTXR.exe
  C:\Windows\System\JxrLTXR.exe
  2⤵
  PID:3120
- C:\Windows\System\VffUmwq.exe
  C:\Windows\System\VffUmwq.exe
  2⤵
  PID:3136
- C:\Windows\System\HMBbGSN.exe
  C:\Windows\System\HMBbGSN.exe
  2⤵
  PID:3152
- C:\Windows\System\WoIupHl.exe
  C:\Windows\System\WoIupHl.exe
  2⤵
  PID:3168
- C:\Windows\System\BriPXpv.exe
  C:\Windows\System\BriPXpv.exe
  2⤵
  PID:3184
- C:\Windows\System\rnxcmFi.exe
  C:\Windows\System\rnxcmFi.exe
  2⤵
  PID:3200
- C:\Windows\System\ThELDhx.exe
  C:\Windows\System\ThELDhx.exe
  2⤵
  PID:3220
- C:\Windows\System\pZisojs.exe
  C:\Windows\System\pZisojs.exe
  2⤵
  PID:3236
- C:\Windows\System\Ecmxcmn.exe
  C:\Windows\System\Ecmxcmn.exe
  2⤵
  PID:3252
- C:\Windows\System\sndqiWO.exe
  C:\Windows\System\sndqiWO.exe
  2⤵
  PID:3268
- C:\Windows\System\OZGALlw.exe
  C:\Windows\System\OZGALlw.exe
  2⤵
  PID:3284
- C:\Windows\System\GQlNKvT.exe
  C:\Windows\System\GQlNKvT.exe
  2⤵
  PID:3300
- C:\Windows\System\uLVQLbO.exe
  C:\Windows\System\uLVQLbO.exe
  2⤵
  PID:3316
- C:\Windows\System\TBvrlGE.exe
  C:\Windows\System\TBvrlGE.exe
  2⤵
  PID:3332
- C:\Windows\System\nccOYFs.exe
  C:\Windows\System\nccOYFs.exe
  2⤵
  PID:3348
- C:\Windows\System\KcTjpGo.exe
  C:\Windows\System\KcTjpGo.exe
  2⤵
  PID:3368
- C:\Windows\System\yIRErrc.exe
  C:\Windows\System\yIRErrc.exe
  2⤵
  PID:3384
- C:\Windows\System\eyNOVfZ.exe
  C:\Windows\System\eyNOVfZ.exe
  2⤵
  PID:3404
- C:\Windows\System\mbVooKv.exe
  C:\Windows\System\mbVooKv.exe
  2⤵
  PID:3420
- C:\Windows\System\MfQoeid.exe
  C:\Windows\System\MfQoeid.exe
  2⤵
  PID:3436
- C:\Windows\System\pnknwvr.exe
  C:\Windows\System\pnknwvr.exe
  2⤵
  PID:3452
- C:\Windows\System\JzijSbc.exe
  C:\Windows\System\JzijSbc.exe
  2⤵
  PID:3472
- C:\Windows\System\ihEQOca.exe
  C:\Windows\System\ihEQOca.exe
  2⤵
  PID:3560
- C:\Windows\System\ojwsMiY.exe
  C:\Windows\System\ojwsMiY.exe
  2⤵
  PID:3580
- C:\Windows\System\nGgvyEw.exe
  C:\Windows\System\nGgvyEw.exe
  2⤵
  PID:3600
- C:\Windows\System\grAspOi.exe
  C:\Windows\System\grAspOi.exe
  2⤵
  PID:3616
- C:\Windows\System\TBAguLs.exe
  C:\Windows\System\TBAguLs.exe
  2⤵
  PID:3636
- C:\Windows\System\fzPmsDu.exe
  C:\Windows\System\fzPmsDu.exe
  2⤵
  PID:3652
- C:\Windows\System\hGUSOUC.exe
  C:\Windows\System\hGUSOUC.exe
  2⤵
  PID:3668
- C:\Windows\System\hnaGctN.exe
  C:\Windows\System\hnaGctN.exe
  2⤵
  PID:3684
- C:\Windows\System\NGRvkVR.exe
  C:\Windows\System\NGRvkVR.exe
  2⤵
  PID:3700
- C:\Windows\System\PlGeixn.exe
  C:\Windows\System\PlGeixn.exe
  2⤵
  PID:3752
- C:\Windows\System\kHUIzWT.exe
  C:\Windows\System\kHUIzWT.exe
  2⤵
  PID:3768
- C:\Windows\System\hXUcGKr.exe
  C:\Windows\System\hXUcGKr.exe
  2⤵
  PID:3788
- C:\Windows\System\LfcptgD.exe
  C:\Windows\System\LfcptgD.exe
  2⤵
  PID:3832
- C:\Windows\System\GnxbpAy.exe
  C:\Windows\System\GnxbpAy.exe
  2⤵
  PID:3848
- C:\Windows\System\LTRHRTH.exe
  C:\Windows\System\LTRHRTH.exe
  2⤵
  PID:3864
- C:\Windows\System\ByLuKof.exe
  C:\Windows\System\ByLuKof.exe
  2⤵
  PID:3992
- C:\Windows\System\oxTzZon.exe
  C:\Windows\System\oxTzZon.exe
  2⤵
  PID:4008
- C:\Windows\System\EDMrBkI.exe
  C:\Windows\System\EDMrBkI.exe
  2⤵
  PID:4028
- C:\Windows\System\fRmjNXk.exe
  C:\Windows\System\fRmjNXk.exe
  2⤵
  PID:4056
- C:\Windows\System\ozTZNFX.exe
  C:\Windows\System\ozTZNFX.exe
  2⤵
  PID:4076
- C:\Windows\System\dcMUZhv.exe
  C:\Windows\System\dcMUZhv.exe
  2⤵
  PID:760
- C:\Windows\System\iIWkKMS.exe
  C:\Windows\System\iIWkKMS.exe
  2⤵
  PID:2636
- C:\Windows\System\iBJJWTP.exe
  C:\Windows\System\iBJJWTP.exe
  2⤵
  PID:1856
- C:\Windows\System\IShKHiG.exe
  C:\Windows\System\IShKHiG.exe
  2⤵
  PID:2960
- C:\Windows\System\XaFxHMM.exe
  C:\Windows\System\XaFxHMM.exe
  2⤵
  PID:3076
- C:\Windows\System\UfpOTrE.exe
  C:\Windows\System\UfpOTrE.exe
  2⤵
  PID:3112
- C:\Windows\System\bTXbSgd.exe
  C:\Windows\System\bTXbSgd.exe
  2⤵
  PID:3180
- C:\Windows\System\TEdHcHI.exe
  C:\Windows\System\TEdHcHI.exe
  2⤵
  PID:3244
- C:\Windows\System\rywzadj.exe
  C:\Windows\System\rywzadj.exe
  2⤵
  PID:3312
- C:\Windows\System\JhVaouO.exe
  C:\Windows\System\JhVaouO.exe
  2⤵
  PID:3412
- C:\Windows\System\OcSnuUx.exe
  C:\Windows\System\OcSnuUx.exe
  2⤵
  PID:3480
- C:\Windows\System\TOqESaV.exe
  C:\Windows\System\TOqESaV.exe
  2⤵
  PID:2304
- C:\Windows\System\ULFkeIV.exe
  C:\Windows\System\ULFkeIV.exe
  2⤵
  PID:3516
- C:\Windows\System\UvrzHow.exe
  C:\Windows\System\UvrzHow.exe
  2⤵
  PID:3536
- C:\Windows\System\KIWPQiX.exe
  C:\Windows\System\KIWPQiX.exe
  2⤵
  PID:1372
- C:\Windows\System\HPQOZGQ.exe
  C:\Windows\System\HPQOZGQ.exe
  2⤵
  PID:2236
- C:\Windows\System\YCmMkaS.exe
  C:\Windows\System\YCmMkaS.exe
  2⤵
  PID:668
- C:\Windows\System\gQfTmoA.exe
  C:\Windows\System\gQfTmoA.exe
  2⤵
  PID:2036
- C:\Windows\System\LnyUoyV.exe
  C:\Windows\System\LnyUoyV.exe
  2⤵
  PID:2432
- C:\Windows\System\rVIwtaj.exe
  C:\Windows\System\rVIwtaj.exe
  2⤵
  PID:1556
- C:\Windows\System\UVmHoCs.exe
  C:\Windows\System\UVmHoCs.exe
  2⤵
  PID:2508
- C:\Windows\System\HEXdEOl.exe
  C:\Windows\System\HEXdEOl.exe
  2⤵
  PID:740
- C:\Windows\System\jiJRNUD.exe
  C:\Windows\System\jiJRNUD.exe
  2⤵
  PID:2244
- C:\Windows\System\hgOLJyv.exe
  C:\Windows\System\hgOLJyv.exe
  2⤵
  PID:3040
- C:\Windows\System\TsfLXdb.exe
  C:\Windows\System\TsfLXdb.exe
  2⤵
  PID:2320
- C:\Windows\System\IqxZNju.exe
  C:\Windows\System\IqxZNju.exe
  2⤵
  PID:2052
- C:\Windows\System\pYoWdgG.exe
  C:\Windows\System\pYoWdgG.exe
  2⤵
  PID:1992
- C:\Windows\System\MWZOwxL.exe
  C:\Windows\System\MWZOwxL.exe
  2⤵
  PID:3132
- C:\Windows\System\pZXEVmM.exe
  C:\Windows\System\pZXEVmM.exe
  2⤵
  PID:2428
- C:\Windows\System\UzUReWo.exe
  C:\Windows\System\UzUReWo.exe
  2⤵
  PID:3592
- C:\Windows\System\xbkcfdr.exe
  C:\Windows\System\xbkcfdr.exe
  2⤵
  PID:3632
- C:\Windows\System\rMfYCGJ.exe
  C:\Windows\System\rMfYCGJ.exe
  2⤵
  PID:3544
- C:\Windows\System\hhDObrw.exe
  C:\Windows\System\hhDObrw.exe
  2⤵
  PID:3796
- C:\Windows\System\XwoSRVx.exe
  C:\Windows\System\XwoSRVx.exe
  2⤵
  PID:3128
- C:\Windows\System\NLsAyWu.exe
  C:\Windows\System\NLsAyWu.exe
  2⤵
  PID:1716
- C:\Windows\System\xqgvtZc.exe
  C:\Windows\System\xqgvtZc.exe
  2⤵
  PID:3800
- C:\Windows\System\rTHbFoG.exe
  C:\Windows\System\rTHbFoG.exe
  2⤵
  PID:3820
- C:\Windows\System\VCnxowm.exe
  C:\Windows\System\VCnxowm.exe
  2⤵
  PID:3860
- C:\Windows\System\iGuVWwv.exe
  C:\Windows\System\iGuVWwv.exe
  2⤵
  PID:2568
- C:\Windows\System\boniwXc.exe
  C:\Windows\System\boniwXc.exe
  2⤵
  PID:3356
- C:\Windows\System\aqwBYko.exe
  C:\Windows\System\aqwBYko.exe
  2⤵
  PID:2496
- C:\Windows\System\sFiGxZa.exe
  C:\Windows\System\sFiGxZa.exe
  2⤵
  PID:3396
- C:\Windows\System\QKFQsVc.exe
  C:\Windows\System\QKFQsVc.exe
  2⤵
  PID:3464
- C:\Windows\System\sFYwQvp.exe
  C:\Windows\System\sFYwQvp.exe
  2⤵
  PID:1720
- C:\Windows\System\bWoQGBc.exe
  C:\Windows\System\bWoQGBc.exe
  2⤵
  PID:3576
- C:\Windows\System\HVCIgFb.exe
  C:\Windows\System\HVCIgFb.exe
  2⤵
  PID:3724
- C:\Windows\System\FMUhpyt.exe
  C:\Windows\System\FMUhpyt.exe
  2⤵
  PID:3740
- C:\Windows\System\qPJDvly.exe
  C:\Windows\System\qPJDvly.exe
  2⤵
  PID:4036
- C:\Windows\System\AwrdfGs.exe
  C:\Windows\System\AwrdfGs.exe
  2⤵
  PID:3884
- C:\Windows\System\AiTsmns.exe
  C:\Windows\System\AiTsmns.exe
  2⤵
  PID:3920
- C:\Windows\System\HFtDZOb.exe
  C:\Windows\System\HFtDZOb.exe
  2⤵
  PID:3936
- C:\Windows\System\NkmeZRj.exe
  C:\Windows\System\NkmeZRj.exe
  2⤵
  PID:3956
- C:\Windows\System\KClwAVH.exe
  C:\Windows\System\KClwAVH.exe
  2⤵
  PID:3680
- C:\Windows\System\OBqCuqz.exe
  C:\Windows\System\OBqCuqz.exe
  2⤵
  PID:3968
- C:\Windows\System\FXKfdTF.exe
  C:\Windows\System\FXKfdTF.exe
  2⤵
  PID:4016
- C:\Windows\System\GBiXsYQ.exe
  C:\Windows\System\GBiXsYQ.exe
  2⤵
  PID:4064
- C:\Windows\System\bbiuiMB.exe
  C:\Windows\System\bbiuiMB.exe
  2⤵
  PID:4068
- C:\Windows\System\xeLaaeG.exe
  C:\Windows\System\xeLaaeG.exe
  2⤵
  PID:2240
- C:\Windows\System\UIXxUaA.exe
  C:\Windows\System\UIXxUaA.exe
  2⤵
  PID:2416
- C:\Windows\System\zlgUalG.exe
  C:\Windows\System\zlgUalG.exe
  2⤵
  PID:2140
- C:\Windows\System\EvhLSnq.exe
  C:\Windows\System\EvhLSnq.exe
  2⤵
  PID:2764
- C:\Windows\System\pANcmaY.exe
  C:\Windows\System\pANcmaY.exe
  2⤵
  PID:3116
- C:\Windows\System\phipJTP.exe
  C:\Windows\System\phipJTP.exe
  2⤵
  PID:3216
- C:\Windows\System\kMBZOVL.exe
  C:\Windows\System\kMBZOVL.exe
  2⤵
  PID:892
- C:\Windows\System\GoTZsdx.exe
  C:\Windows\System\GoTZsdx.exe
  2⤵
  PID:3484
- C:\Windows\System\tYNyJeN.exe
  C:\Windows\System\tYNyJeN.exe
  2⤵
  PID:3512
- C:\Windows\System\TzfVfYG.exe
  C:\Windows\System\TzfVfYG.exe
  2⤵
  PID:2612
- C:\Windows\System\AWhjzkf.exe
  C:\Windows\System\AWhjzkf.exe
  2⤵
  PID:3532
- C:\Windows\System\KAtkRsD.exe
  C:\Windows\System\KAtkRsD.exe
  2⤵
  PID:928
- C:\Windows\System\nIGyTyv.exe
  C:\Windows\System\nIGyTyv.exe
  2⤵
  PID:2076
- C:\Windows\System\WMUyhho.exe
  C:\Windows\System\WMUyhho.exe
  2⤵
  PID:2980
- C:\Windows\System\LQRLirK.exe
  C:\Windows\System\LQRLirK.exe
  2⤵
  PID:1664
- C:\Windows\System\vwWGuvg.exe
  C:\Windows\System\vwWGuvg.exe
  2⤵
  PID:1580
- C:\Windows\System\PchbmAW.exe
  C:\Windows\System\PchbmAW.exe
  2⤵
  PID:2172
- C:\Windows\System\dzoHjXk.exe
  C:\Windows\System\dzoHjXk.exe
  2⤵
  PID:1456
- C:\Windows\System\DtZcfEZ.exe
  C:\Windows\System\DtZcfEZ.exe
  2⤵
  PID:2888
- C:\Windows\System\QtLkeXy.exe
  C:\Windows\System\QtLkeXy.exe
  2⤵
  PID:1904
- C:\Windows\System\hHYTKmz.exe
  C:\Windows\System\hHYTKmz.exe
  2⤵
  PID:3540
- C:\Windows\System\NLPksiS.exe
  C:\Windows\System\NLPksiS.exe
  2⤵
  PID:1180
- C:\Windows\System\tHScjtL.exe
  C:\Windows\System\tHScjtL.exe
  2⤵
  PID:692
- C:\Windows\System\umGcnyk.exe
  C:\Windows\System\umGcnyk.exe
  2⤵
  PID:3196
- C:\Windows\System\wZfqkhy.exe
  C:\Windows\System\wZfqkhy.exe
  2⤵
  PID:1448
- C:\Windows\System\fTWGyWt.exe
  C:\Windows\System\fTWGyWt.exe
  2⤵
  PID:1960
- C:\Windows\System\XxDlDVF.exe
  C:\Windows\System\XxDlDVF.exe
  2⤵
  PID:3232
- C:\Windows\System\hFnKBXD.exe
  C:\Windows\System\hFnKBXD.exe
  2⤵
  PID:3364
- C:\Windows\System\KsTwpBK.exe
  C:\Windows\System\KsTwpBK.exe
  2⤵
  PID:3428
- C:\Windows\System\mCHxCsF.exe
  C:\Windows\System\mCHxCsF.exe
  2⤵
  PID:3568
- C:\Windows\System\wMHXumE.exe
  C:\Windows\System\wMHXumE.exe
  2⤵
  PID:3784
- C:\Windows\System\CqYZbEN.exe
  C:\Windows\System\CqYZbEN.exe
  2⤵
  PID:3840
- C:\Windows\System\dapKVOA.exe
  C:\Windows\System\dapKVOA.exe
  2⤵
  PID:4004
- C:\Windows\System\WozqNIl.exe
  C:\Windows\System\WozqNIl.exe
  2⤵
  PID:3932
- C:\Windows\System\vfcDKpl.exe
  C:\Windows\System\vfcDKpl.exe
  2⤵
  PID:1524
- C:\Windows\System\fVPxNPa.exe
  C:\Windows\System\fVPxNPa.exe
  2⤵
  PID:3980
- C:\Windows\System\DVTTFSk.exe
  C:\Windows\System\DVTTFSk.exe
  2⤵
  PID:4092
- C:\Windows\System\IsySlPI.exe
  C:\Windows\System\IsySlPI.exe
  2⤵
  PID:1872
- C:\Windows\System\aNOmjWT.exe
  C:\Windows\System\aNOmjWT.exe
  2⤵
  PID:3912
- C:\Windows\System\vCsqFih.exe
  C:\Windows\System\vCsqFih.exe
  2⤵
  PID:4052
- C:\Windows\System\yufdYfh.exe
  C:\Windows\System\yufdYfh.exe
  2⤵
  PID:3148
- C:\Windows\System\gbsxyKc.exe
  C:\Windows\System\gbsxyKc.exe
  2⤵
  PID:3496
- C:\Windows\System\VNUGZbq.exe
  C:\Windows\System\VNUGZbq.exe
  2⤵
  PID:3308
- C:\Windows\System\qpDxopT.exe
  C:\Windows\System\qpDxopT.exe
  2⤵
  PID:3524
- C:\Windows\System\pfsfQUb.exe
  C:\Windows\System\pfsfQUb.exe
  2⤵
  PID:2436
- C:\Windows\System\gFPKYyu.exe
  C:\Windows\System\gFPKYyu.exe
  2⤵
  PID:2900
- C:\Windows\System\FmjzmOB.exe
  C:\Windows\System\FmjzmOB.exe
  2⤵
  PID:2096
- C:\Windows\System\ZOWdgmx.exe
  C:\Windows\System\ZOWdgmx.exe
  2⤵
  PID:2056
- C:\Windows\System\SNtuttB.exe
  C:\Windows\System\SNtuttB.exe
  2⤵
  PID:2356
- C:\Windows\System\kxguaYl.exe
  C:\Windows\System\kxguaYl.exe
  2⤵
  PID:3096
- C:\Windows\System\BlRMGOX.exe
  C:\Windows\System\BlRMGOX.exe
  2⤵
  PID:1888
- C:\Windows\System\VpkcZXt.exe
  C:\Windows\System\VpkcZXt.exe
  2⤵
  PID:3644
- C:\Windows\System\KjJpaeB.exe
  C:\Windows\System\KjJpaeB.exe
  2⤵
  PID:3064
- C:\Windows\System\WsHZTYe.exe
  C:\Windows\System\WsHZTYe.exe
  2⤵
  PID:2152
- C:\Windows\System\JSvsGBe.exe
  C:\Windows\System\JSvsGBe.exe
  2⤵
  PID:2492
- C:\Windows\System\nYxgwol.exe
  C:\Windows\System\nYxgwol.exe
  2⤵
  PID:2728
- C:\Windows\System\cWChosr.exe
  C:\Windows\System\cWChosr.exe
  2⤵
  PID:2608
- C:\Windows\System\UGIxyQO.exe
  C:\Windows\System\UGIxyQO.exe
  2⤵
  PID:272
- C:\Windows\System\cHhliAO.exe
  C:\Windows\System\cHhliAO.exe
  2⤵
  PID:2280
- C:\Windows\System\WxaqObs.exe
  C:\Windows\System\WxaqObs.exe
  2⤵
  PID:2556
- C:\Windows\System\YlKnANy.exe
  C:\Windows\System\YlKnANy.exe
  2⤵
  PID:1268
- C:\Windows\System\rtHJOPU.exe
  C:\Windows\System\rtHJOPU.exe
  2⤵
  PID:3812
- C:\Windows\System\kzuLYmk.exe
  C:\Windows\System\kzuLYmk.exe
  2⤵
  PID:3816
- C:\Windows\System\UgOhnOc.exe
  C:\Windows\System\UgOhnOc.exe
  2⤵
  PID:3780
- C:\Windows\System\LPxXgDz.exe
  C:\Windows\System\LPxXgDz.exe
  2⤵
  PID:4048
- C:\Windows\System\gsDDNPE.exe
  C:\Windows\System\gsDDNPE.exe
  2⤵
  PID:3908
- C:\Windows\System\MKFcObD.exe
  C:\Windows\System\MKFcObD.exe
  2⤵
  PID:4136
- C:\Windows\System\gFcdVjb.exe
  C:\Windows\System\gFcdVjb.exe
  2⤵
  PID:4152
- C:\Windows\System\aXeqwJP.exe
  C:\Windows\System\aXeqwJP.exe
  2⤵
  PID:4168
- C:\Windows\System\BrQqCXv.exe
  C:\Windows\System\BrQqCXv.exe
  2⤵
  PID:4184
- C:\Windows\System\bkgxlKL.exe
  C:\Windows\System\bkgxlKL.exe
  2⤵
  PID:4200
- C:\Windows\System\kmdFsVc.exe
  C:\Windows\System\kmdFsVc.exe
  2⤵
  PID:4216
- C:\Windows\System\jUPaoAJ.exe
  C:\Windows\System\jUPaoAJ.exe
  2⤵
  PID:4236
- C:\Windows\System\IxFTens.exe
  C:\Windows\System\IxFTens.exe
  2⤵
  PID:4252
- C:\Windows\System\DnNQLKh.exe
  C:\Windows\System\DnNQLKh.exe
  2⤵
  PID:4268
- C:\Windows\System\aLhgxyW.exe
  C:\Windows\System\aLhgxyW.exe
  2⤵
  PID:4284
- C:\Windows\System\yVcrdrO.exe
  C:\Windows\System\yVcrdrO.exe
  2⤵
  PID:4360
- C:\Windows\System\rCUsQmA.exe
  C:\Windows\System\rCUsQmA.exe
  2⤵
  PID:4376
- C:\Windows\System\KjjBHIr.exe
  C:\Windows\System\KjjBHIr.exe
  2⤵
  PID:4392
- C:\Windows\System\BboDCBP.exe
  C:\Windows\System\BboDCBP.exe
  2⤵
  PID:4408
- C:\Windows\System\CEpXDJf.exe
  C:\Windows\System\CEpXDJf.exe
  2⤵
  PID:4424
- C:\Windows\System\NSrPaEi.exe
  C:\Windows\System\NSrPaEi.exe
  2⤵
  PID:4440
- C:\Windows\System\FRkjTBq.exe
  C:\Windows\System\FRkjTBq.exe
  2⤵
  PID:4456
- C:\Windows\System\gumNzcT.exe
  C:\Windows\System\gumNzcT.exe
  2⤵
  PID:4472
- C:\Windows\System\KGKYTxt.exe
  C:\Windows\System\KGKYTxt.exe
  2⤵
  PID:4488
- C:\Windows\System\PokghiC.exe
  C:\Windows\System\PokghiC.exe
  2⤵
  PID:4504
- C:\Windows\System\sKUTTeM.exe
  C:\Windows\System\sKUTTeM.exe
  2⤵
  PID:4520
- C:\Windows\System\CXurqGA.exe
  C:\Windows\System\CXurqGA.exe
  2⤵
  PID:4536
- C:\Windows\System\OVGMSpK.exe
  C:\Windows\System\OVGMSpK.exe
  2⤵
  PID:4552
- C:\Windows\System\CmXZGoQ.exe
  C:\Windows\System\CmXZGoQ.exe
  2⤵
  PID:4568
- C:\Windows\System\QfedYAM.exe
  C:\Windows\System\QfedYAM.exe
  2⤵
  PID:4584
- C:\Windows\System\ugUiVOi.exe
  C:\Windows\System\ugUiVOi.exe
  2⤵
  PID:4600
- C:\Windows\System\QoIjRpX.exe
  C:\Windows\System\QoIjRpX.exe
  2⤵
  PID:4616
- C:\Windows\System\gWPdoMs.exe
  C:\Windows\System\gWPdoMs.exe
  2⤵
  PID:4632
- C:\Windows\System\MXBcNAs.exe
  C:\Windows\System\MXBcNAs.exe
  2⤵
  PID:4648
- C:\Windows\System\SaYWEzd.exe
  C:\Windows\System\SaYWEzd.exe
  2⤵
  PID:4664
- C:\Windows\System\YUMbRVL.exe
  C:\Windows\System\YUMbRVL.exe
  2⤵
  PID:4680
- C:\Windows\System\XzsWgur.exe
  C:\Windows\System\XzsWgur.exe
  2⤵
  PID:4696
- C:\Windows\System\NBzupkU.exe
  C:\Windows\System\NBzupkU.exe
  2⤵
  PID:4736
- C:\Windows\System\JkULbbf.exe
  C:\Windows\System\JkULbbf.exe
  2⤵
  PID:4908
- C:\Windows\System\WWflzIu.exe
  C:\Windows\System\WWflzIu.exe
  2⤵
  PID:4924
- C:\Windows\System\VyWeYZj.exe
  C:\Windows\System\VyWeYZj.exe
  2⤵
  PID:4940
- C:\Windows\System\SJBlPpg.exe
  C:\Windows\System\SJBlPpg.exe
  2⤵
  PID:4968
- C:\Windows\System\eYviWrf.exe
  C:\Windows\System\eYviWrf.exe
  2⤵
  PID:4984
- C:\Windows\System\fqkbvMW.exe
  C:\Windows\System\fqkbvMW.exe
  2⤵
  PID:5004
- C:\Windows\System\rKmjFsO.exe
  C:\Windows\System\rKmjFsO.exe
  2⤵
  PID:5020
- C:\Windows\System\rVvwdBk.exe
  C:\Windows\System\rVvwdBk.exe
  2⤵
  PID:5036
- C:\Windows\System\WQwTVfX.exe
  C:\Windows\System\WQwTVfX.exe
  2⤵
  PID:5052
- C:\Windows\System\QgbKrJH.exe
  C:\Windows\System\QgbKrJH.exe
  2⤵
  PID:5068
- C:\Windows\System\EjOtzvP.exe
  C:\Windows\System\EjOtzvP.exe
  2⤵
  PID:5084
- C:\Windows\System\njbFlaC.exe
  C:\Windows\System\njbFlaC.exe
  2⤵
  PID:2792
- C:\Windows\System\vQDnUwo.exe
  C:\Windows\System\vQDnUwo.exe
  2⤵
  PID:3880
- C:\Windows\System\jCCdxcV.exe
  C:\Windows\System\jCCdxcV.exe
  2⤵
  PID:888
- C:\Windows\System\jUsxCiE.exe
  C:\Windows\System\jUsxCiE.exe
  2⤵
  PID:3444
- C:\Windows\System\kGBiBhC.exe
  C:\Windows\System\kGBiBhC.exe
  2⤵
  PID:1672
- C:\Windows\System\XVtdhbx.exe
  C:\Windows\System\XVtdhbx.exe
  2⤵
  PID:1584
- C:\Windows\System\RZdCiwu.exe
  C:\Windows\System\RZdCiwu.exe
  2⤵
  PID:4044
- C:\Windows\System\YOWYGiV.exe
  C:\Windows\System\YOWYGiV.exe
  2⤵
  PID:2468
- C:\Windows\System\DietjrB.exe
  C:\Windows\System\DietjrB.exe
  2⤵
  PID:3776
- C:\Windows\System\IaWWhJT.exe
  C:\Windows\System\IaWWhJT.exe
  2⤵
  PID:4148
- C:\Windows\System\pUlVKgb.exe
  C:\Windows\System\pUlVKgb.exe
  2⤵
  PID:4212
- C:\Windows\System\hwLIxUN.exe
  C:\Windows\System\hwLIxUN.exe
  2⤵
  PID:2684
- C:\Windows\System\UEuOnHu.exe
  C:\Windows\System\UEuOnHu.exe
  2⤵
  PID:1048
- C:\Windows\System\vohcDjU.exe
  C:\Windows\System\vohcDjU.exe
  2⤵
  PID:3492
- C:\Windows\System\WlMEFis.exe
  C:\Windows\System\WlMEFis.exe
  2⤵
  PID:588
- C:\Windows\System\shwNwbg.exe
  C:\Windows\System\shwNwbg.exe
  2⤵
  PID:4112
- C:\Windows\System\RUKUqzD.exe
  C:\Windows\System\RUKUqzD.exe
  2⤵
  PID:3108
- C:\Windows\System\MKioodk.exe
  C:\Windows\System\MKioodk.exe
  2⤵
  PID:4296
- C:\Windows\System\vdKCuQx.exe
  C:\Windows\System\vdKCuQx.exe
  2⤵
  PID:4276
- C:\Windows\System\ZHwhxeI.exe
  C:\Windows\System\ZHwhxeI.exe
  2⤵
  PID:4308
- C:\Windows\System\OhRjrQs.exe
  C:\Windows\System\OhRjrQs.exe
  2⤵
  PID:4320
- C:\Windows\System\YSDnSKc.exe
  C:\Windows\System\YSDnSKc.exe
  2⤵
  PID:4160
- C:\Windows\System\jqpRxBV.exe
  C:\Windows\System\jqpRxBV.exe
  2⤵
  PID:4712
- C:\Windows\System\nGSOmLM.exe
  C:\Windows\System\nGSOmLM.exe
  2⤵
  PID:4348
- C:\Windows\System\egtOaWh.exe
  C:\Windows\System\egtOaWh.exe
  2⤵
  PID:4748
- C:\Windows\System\hRWoThR.exe
  C:\Windows\System\hRWoThR.exe
  2⤵
  PID:4768
- C:\Windows\System\rbAevFz.exe
  C:\Windows\System\rbAevFz.exe
  2⤵
  PID:4788
- C:\Windows\System\paZJEce.exe
  C:\Windows\System\paZJEce.exe
  2⤵
  PID:4496
- C:\Windows\System\gzTuzUk.exe
  C:\Windows\System\gzTuzUk.exe
  2⤵
  PID:4436
- C:\Windows\System\WAzNbBk.exe
  C:\Windows\System\WAzNbBk.exe
  2⤵
  PID:4512
- C:\Windows\System\qCjVZps.exe
  C:\Windows\System\qCjVZps.exe
  2⤵
  PID:4608
- C:\Windows\System\ynbAbXK.exe
  C:\Windows\System\ynbAbXK.exe
  2⤵
  PID:4516
- C:\Windows\System\ueOjtnT.exe
  C:\Windows\System\ueOjtnT.exe
  2⤵
  PID:4688
- C:\Windows\System\hEIjKSG.exe
  C:\Windows\System\hEIjKSG.exe
  2⤵
  PID:4628
- C:\Windows\System\YWkxNyJ.exe
  C:\Windows\System\YWkxNyJ.exe
  2⤵
  PID:4420
- C:\Windows\System\MALUPCD.exe
  C:\Windows\System\MALUPCD.exe
  2⤵
  PID:4676
- C:\Windows\System\pweUfKH.exe
  C:\Windows\System\pweUfKH.exe
  2⤵
  PID:4808
- C:\Windows\System\YYSOjfy.exe
  C:\Windows\System\YYSOjfy.exe
  2⤵
  PID:4816
- C:\Windows\System\XWEaaeG.exe
  C:\Windows\System\XWEaaeG.exe
  2⤵
  PID:4832
- C:\Windows\System\umUaWtv.exe
  C:\Windows\System\umUaWtv.exe
  2⤵
  PID:4844
- C:\Windows\System\ulEGexw.exe
  C:\Windows\System\ulEGexw.exe
  2⤵
  PID:4864
- C:\Windows\System\EmVFhOs.exe
  C:\Windows\System\EmVFhOs.exe
  2⤵
  PID:4880
- C:\Windows\System\jJgdcxS.exe
  C:\Windows\System\jJgdcxS.exe
  2⤵
  PID:4892
- C:\Windows\System\JKZMoHS.exe
  C:\Windows\System\JKZMoHS.exe
  2⤵
  PID:4916
- C:\Windows\System\MDnnVHZ.exe
  C:\Windows\System\MDnnVHZ.exe
  2⤵
  PID:4948
- C:\Windows\System\HjDbubT.exe
  C:\Windows\System\HjDbubT.exe
  2⤵
  PID:5044
- C:\Windows\System\WUquCKu.exe
  C:\Windows\System\WUquCKu.exe
  2⤵
  PID:1368
- C:\Windows\System\ndzCaQl.exe
  C:\Windows\System\ndzCaQl.exe
  2⤵
  PID:3928
- C:\Windows\System\keUhGzb.exe
  C:\Windows\System\keUhGzb.exe
  2⤵
  PID:2168
- C:\Windows\System\VsMiJBp.exe
  C:\Windows\System\VsMiJBp.exe
  2⤵
  PID:3508
- C:\Windows\System\RHrZhkA.exe
  C:\Windows\System\RHrZhkA.exe
  2⤵
  PID:2572
- C:\Windows\System\LfRPdCM.exe
  C:\Windows\System\LfRPdCM.exe
  2⤵
  PID:3808
- C:\Windows\System\EcgkbjE.exe
  C:\Windows\System\EcgkbjE.exe
  2⤵
  PID:2552
- C:\Windows\System\LXutHQv.exe
  C:\Windows\System\LXutHQv.exe
  2⤵
  PID:4180
- C:\Windows\System\lPYUGoo.exe
  C:\Windows\System\lPYUGoo.exe
  2⤵
  PID:3324
- C:\Windows\System\gedVqSq.exe
  C:\Windows\System\gedVqSq.exe
  2⤵
  PID:4192
- C:\Windows\System\JdiJKZw.exe
  C:\Windows\System\JdiJKZw.exe
  2⤵
  PID:1252
- C:\Windows\System\wJJsPxK.exe
  C:\Windows\System\wJJsPxK.exe
  2⤵
  PID:4300
- C:\Windows\System\ivZnahQ.exe
  C:\Windows\System\ivZnahQ.exe
  2⤵
  PID:4340
- C:\Windows\System\HxkhRkr.exe
  C:\Windows\System\HxkhRkr.exe
  2⤵
  PID:4724
- C:\Windows\System\LQtkVrc.exe
  C:\Windows\System\LQtkVrc.exe
  2⤵
  PID:1572
- C:\Windows\System\GFCSsnX.exe
  C:\Windows\System\GFCSsnX.exe
  2⤵
  PID:4780
- C:\Windows\System\jMWWBUP.exe
  C:\Windows\System\jMWWBUP.exe
  2⤵
  PID:4592
- C:\Windows\System\qGtqmvR.exe
  C:\Windows\System\qGtqmvR.exe
  2⤵
  PID:4336
- C:\Windows\System\xUgfPvO.exe
  C:\Windows\System\xUgfPvO.exe
  2⤵
  PID:4800
- C:\Windows\System\CAfZwVg.exe
  C:\Windows\System\CAfZwVg.exe
  2⤵
  PID:4804
- C:\Windows\System\lYKbJiN.exe
  C:\Windows\System\lYKbJiN.exe
  2⤵
  PID:4920
- C:\Windows\System\TCAYQFb.exe
  C:\Windows\System\TCAYQFb.exe
  2⤵
  PID:4468
- C:\Windows\System\ZZdWzMy.exe
  C:\Windows\System\ZZdWzMy.exe
  2⤵
  PID:4996
- C:\Windows\System\agsDIAE.exe
  C:\Windows\System\agsDIAE.exe
  2⤵
  PID:4384
- C:\Windows\System\wKjEIYf.exe
  C:\Windows\System\wKjEIYf.exe
  2⤵
  PID:4976
- C:\Windows\System\ZJPKozx.exe
  C:\Windows\System\ZJPKozx.exe
  2⤵
  PID:5016
- C:\Windows\System\KcaCLLm.exe
  C:\Windows\System\KcaCLLm.exe
  2⤵
  PID:5060
- C:\Windows\System\zOyvLfr.exe
  C:\Windows\System\zOyvLfr.exe
  2⤵
  PID:4860
- C:\Windows\System\ZIuDgEY.exe
  C:\Windows\System\ZIuDgEY.exe
  2⤵
  PID:4856
- C:\Windows\System\XIAUGKn.exe
  C:\Windows\System\XIAUGKn.exe
  2⤵
  PID:5112
- C:\Windows\System\XDLSxhv.exe
  C:\Windows\System\XDLSxhv.exe
  2⤵
  PID:5076
- C:\Windows\System\ArwPalL.exe
  C:\Windows\System\ArwPalL.exe
  2⤵
  PID:3916
- C:\Windows\System\YkTqcBx.exe
  C:\Windows\System\YkTqcBx.exe
  2⤵
  PID:2656
- C:\Windows\System\aqXYCWJ.exe
  C:\Windows\System\aqXYCWJ.exe
  2⤵
  PID:3392
- C:\Windows\System\HxkmOlO.exe
  C:\Windows\System\HxkmOlO.exe
  2⤵
  PID:1184
- C:\Windows\System\SWZIVrJ.exe
  C:\Windows\System\SWZIVrJ.exe
  2⤵
  PID:1128
- C:\Windows\System\tpGEgVc.exe
  C:\Windows\System\tpGEgVc.exe
  2⤵
  PID:4120
- C:\Windows\System\KKepfiO.exe
  C:\Windows\System\KKepfiO.exe
  2⤵
  PID:1688
- C:\Windows\System\nqAkbEr.exe
  C:\Windows\System\nqAkbEr.exe
  2⤵
  PID:4128
- C:\Windows\System\hfUGiSs.exe
  C:\Windows\System\hfUGiSs.exe
  2⤵
  PID:4328
- C:\Windows\System\AVwAfYy.exe
  C:\Windows\System\AVwAfYy.exe
  2⤵
  PID:4716
- C:\Windows\System\EjbQzeS.exe
  C:\Windows\System\EjbQzeS.exe
  2⤵
  PID:2876
- C:\Windows\System\eIKgdXb.exe
  C:\Windows\System\eIKgdXb.exe
  2⤵
  PID:4332
- C:\Windows\System\YbSpSku.exe
  C:\Windows\System\YbSpSku.exe
  2⤵
  PID:4624
- C:\Windows\System\ZjAjCRV.exe
  C:\Windows\System\ZjAjCRV.exe
  2⤵
  PID:4828
- C:\Windows\System\XPGDEWm.exe
  C:\Windows\System\XPGDEWm.exe
  2⤵
  PID:4528
- C:\Windows\System\MgRwMtZ.exe
  C:\Windows\System\MgRwMtZ.exe
  2⤵
  PID:4400
- C:\Windows\System\SyayQyh.exe
  C:\Windows\System\SyayQyh.exe
  2⤵
  PID:4612
- C:\Windows\System\ZirDHtB.exe
  C:\Windows\System\ZirDHtB.exe
  2⤵
  PID:5096
- C:\Windows\System\UQJnqfM.exe
  C:\Windows\System\UQJnqfM.exe
  2⤵
  PID:5092
- C:\Windows\System\iBSBGbC.exe
  C:\Windows\System\iBSBGbC.exe
  2⤵
  PID:4580
- C:\Windows\System\oPoNGLS.exe
  C:\Windows\System\oPoNGLS.exe
  2⤵
  PID:4876
- C:\Windows\System\DFxGbuB.exe
  C:\Windows\System\DFxGbuB.exe
  2⤵
  PID:5108
- C:\Windows\System\AiAdOuL.exe
  C:\Windows\System\AiAdOuL.exe
  2⤵
  PID:1108
- C:\Windows\System\LcXUcrq.exe
  C:\Windows\System\LcXUcrq.exe
  2⤵
  PID:3528
- C:\Windows\System\IgHUFjt.exe
  C:\Windows\System\IgHUFjt.exe
  2⤵
  PID:4312
- C:\Windows\System\MoQBvly.exe
  C:\Windows\System\MoQBvly.exe
  2⤵
  PID:3192
- C:\Windows\System\MXvzaIS.exe
  C:\Windows\System\MXvzaIS.exe
  2⤵
  PID:4260
- C:\Windows\System\NDNOHlc.exe
  C:\Windows\System\NDNOHlc.exe
  2⤵
  PID:2440
- C:\Windows\System\dzLpxtC.exe
  C:\Windows\System\dzLpxtC.exe
  2⤵
  PID:4104
- C:\Windows\System\iUlRaVg.exe
  C:\Windows\System\iUlRaVg.exe
  2⤵
  PID:5012
- C:\Windows\System\RoEksbD.exe
  C:\Windows\System\RoEksbD.exe
  2⤵
  PID:4900
- C:\Windows\System\mcvgapb.exe
  C:\Windows\System\mcvgapb.exe
  2⤵
  PID:4596
- C:\Windows\System\Ilbwidc.exe
  C:\Windows\System\Ilbwidc.exe
  2⤵
  PID:5028
- C:\Windows\System\xzGaKax.exe
  C:\Windows\System\xzGaKax.exe
  2⤵
  PID:4904
- C:\Windows\System\FlaHEbn.exe
  C:\Windows\System\FlaHEbn.exe
  2⤵
  PID:4764
- C:\Windows\System\EtxXtMh.exe
  C:\Windows\System\EtxXtMh.exe
  2⤵
  PID:4356
- C:\Windows\System\avqMPHj.exe
  C:\Windows\System\avqMPHj.exe
  2⤵
  PID:3732
- C:\Windows\System\gAVzROV.exe
  C:\Windows\System\gAVzROV.exe
  2⤵
  PID:4852
- C:\Windows\System\AWcRzrE.exe
  C:\Windows\System\AWcRzrE.exe
  2⤵
  PID:4232
- C:\Windows\System\SmJVKVt.exe
  C:\Windows\System\SmJVKVt.exe
  2⤵
  PID:3944
- C:\Windows\System\VGCYZLv.exe
  C:\Windows\System\VGCYZLv.exe
  2⤵
  PID:5132
- C:\Windows\System\AsGcMtF.exe
  C:\Windows\System\AsGcMtF.exe
  2⤵
  PID:5148
- C:\Windows\System\SwIHJbf.exe
  C:\Windows\System\SwIHJbf.exe
  2⤵
  PID:5164
- C:\Windows\System\JURFCzf.exe
  C:\Windows\System\JURFCzf.exe
  2⤵
  PID:5180
- C:\Windows\System\wvLVBKO.exe
  C:\Windows\System\wvLVBKO.exe
  2⤵
  PID:5196
- C:\Windows\System\zapOaVD.exe
  C:\Windows\System\zapOaVD.exe
  2⤵
  PID:5212
- C:\Windows\System\uogIMhv.exe
  C:\Windows\System\uogIMhv.exe
  2⤵
  PID:5228
- C:\Windows\System\RXriCYJ.exe
  C:\Windows\System\RXriCYJ.exe
  2⤵
  PID:5244
- C:\Windows\System\aLqxZBh.exe
  C:\Windows\System\aLqxZBh.exe
  2⤵
  PID:5260
- C:\Windows\System\LcTLslt.exe
  C:\Windows\System\LcTLslt.exe
  2⤵
  PID:5276
- C:\Windows\System\DeLOFnQ.exe
  C:\Windows\System\DeLOFnQ.exe
  2⤵
  PID:5292
- C:\Windows\System\PhDGLnB.exe
  C:\Windows\System\PhDGLnB.exe
  2⤵
  PID:5308
- C:\Windows\System\PNywQSl.exe
  C:\Windows\System\PNywQSl.exe
  2⤵
  PID:5324
- C:\Windows\System\iNyDZkj.exe
  C:\Windows\System\iNyDZkj.exe
  2⤵
  PID:5340
- C:\Windows\System\LoWAQNR.exe
  C:\Windows\System\LoWAQNR.exe
  2⤵
  PID:5356
- C:\Windows\System\wuvNOOg.exe
  C:\Windows\System\wuvNOOg.exe
  2⤵
  PID:5372
- C:\Windows\System\QmUdVPy.exe
  C:\Windows\System\QmUdVPy.exe
  2⤵
  PID:5388
- C:\Windows\System\IihTcmr.exe
  C:\Windows\System\IihTcmr.exe
  2⤵
  PID:5404
- C:\Windows\System\EajOfQa.exe
  C:\Windows\System\EajOfQa.exe
  2⤵
  PID:5420
- C:\Windows\System\EfwBpAs.exe
  C:\Windows\System\EfwBpAs.exe
  2⤵
  PID:5436
- C:\Windows\System\VHWisMD.exe
  C:\Windows\System\VHWisMD.exe
  2⤵
  PID:5452
- C:\Windows\System\iRfnKDG.exe
  C:\Windows\System\iRfnKDG.exe
  2⤵
  PID:5468
- C:\Windows\System\IlCMVaU.exe
  C:\Windows\System\IlCMVaU.exe
  2⤵
  PID:5484
- C:\Windows\System\Yzzoejt.exe
  C:\Windows\System\Yzzoejt.exe
  2⤵
  PID:5500
- C:\Windows\System\NtpvvMK.exe
  C:\Windows\System\NtpvvMK.exe
  2⤵
  PID:5516
- C:\Windows\System\fnPklNJ.exe
  C:\Windows\System\fnPklNJ.exe
  2⤵
  PID:5532
- C:\Windows\System\nlGyoFz.exe
  C:\Windows\System\nlGyoFz.exe
  2⤵
  PID:5548
- C:\Windows\System\hibUUgE.exe
  C:\Windows\System\hibUUgE.exe
  2⤵
  PID:5564
- C:\Windows\System\CAvMmtr.exe
  C:\Windows\System\CAvMmtr.exe
  2⤵
  PID:5580
- C:\Windows\System\mTmpClE.exe
  C:\Windows\System\mTmpClE.exe
  2⤵
  PID:5596
- C:\Windows\System\zZSUvsE.exe
  C:\Windows\System\zZSUvsE.exe
  2⤵
  PID:5612
- C:\Windows\System\uAqksFe.exe
  C:\Windows\System\uAqksFe.exe
  2⤵
  PID:5628
- C:\Windows\System\NMeNnXz.exe
  C:\Windows\System\NMeNnXz.exe
  2⤵
  PID:5644
- C:\Windows\System\mgJEcob.exe
  C:\Windows\System\mgJEcob.exe
  2⤵
  PID:5660
- C:\Windows\System\GZQVMtp.exe
  C:\Windows\System\GZQVMtp.exe
  2⤵
  PID:5676
- C:\Windows\System\iPJirxM.exe
  C:\Windows\System\iPJirxM.exe
  2⤵
  PID:5692
- C:\Windows\System\dJltanZ.exe
  C:\Windows\System\dJltanZ.exe
  2⤵
  PID:5708
- C:\Windows\System\KlcgBKx.exe
  C:\Windows\System\KlcgBKx.exe
  2⤵
  PID:5724
- C:\Windows\System\VbgHOaG.exe
  C:\Windows\System\VbgHOaG.exe
  2⤵
  PID:5740
- C:\Windows\System\BCmsMyG.exe
  C:\Windows\System\BCmsMyG.exe
  2⤵
  PID:5756
- C:\Windows\System\GraImgd.exe
  C:\Windows\System\GraImgd.exe
  2⤵
  PID:5772
- C:\Windows\System\VqcBjeN.exe
  C:\Windows\System\VqcBjeN.exe
  2⤵
  PID:5788
- C:\Windows\System\Hgektbo.exe
  C:\Windows\System\Hgektbo.exe
  2⤵
  PID:5804
- C:\Windows\System\ukHthtd.exe
  C:\Windows\System\ukHthtd.exe
  2⤵
  PID:5820
- C:\Windows\System\oXfCbos.exe
  C:\Windows\System\oXfCbos.exe
  2⤵
  PID:5836
- C:\Windows\System\RHKZquF.exe
  C:\Windows\System\RHKZquF.exe
  2⤵
  PID:5852
- C:\Windows\System\QgfXvzD.exe
  C:\Windows\System\QgfXvzD.exe
  2⤵
  PID:5868
- C:\Windows\System\blHTxjG.exe
  C:\Windows\System\blHTxjG.exe
  2⤵
  PID:5884
- C:\Windows\System\ZFmvshD.exe
  C:\Windows\System\ZFmvshD.exe
  2⤵
  PID:5900
- C:\Windows\System\mXWobtd.exe
  C:\Windows\System\mXWobtd.exe
  2⤵
  PID:5928
- C:\Windows\System\wltyTLl.exe
  C:\Windows\System\wltyTLl.exe
  2⤵
  PID:5944
- C:\Windows\System\gGbHmTe.exe
  C:\Windows\System\gGbHmTe.exe
  2⤵
  PID:5960
- C:\Windows\System\TdfnEMF.exe
  C:\Windows\System\TdfnEMF.exe
  2⤵
  PID:5976
- C:\Windows\System\qkxzJsz.exe
  C:\Windows\System\qkxzJsz.exe
  2⤵
  PID:5992
- C:\Windows\System\hvFUmeE.exe
  C:\Windows\System\hvFUmeE.exe
  2⤵
  PID:6008
- C:\Windows\System\VjToYPe.exe
  C:\Windows\System\VjToYPe.exe
  2⤵
  PID:6024
- C:\Windows\System\dzpOQlc.exe
  C:\Windows\System\dzpOQlc.exe
  2⤵
  PID:6040
- C:\Windows\System\TZiHwOr.exe
  C:\Windows\System\TZiHwOr.exe
  2⤵
  PID:6056
- C:\Windows\System\hDsKeWS.exe
  C:\Windows\System\hDsKeWS.exe
  2⤵
  PID:6072
- C:\Windows\System\MDqdveK.exe
  C:\Windows\System\MDqdveK.exe
  2⤵
  PID:5144
- C:\Windows\System\RnYIMga.exe
  C:\Windows\System\RnYIMga.exe
  2⤵
  PID:5304
- C:\Windows\System\uLNLRYU.exe
  C:\Windows\System\uLNLRYU.exe
  2⤵
  PID:5320
- C:\Windows\System\lcIrkGz.exe
  C:\Windows\System\lcIrkGz.exe
  2⤵
  PID:5396
- C:\Windows\System\eYtcZjH.exe
  C:\Windows\System\eYtcZjH.exe
  2⤵
  PID:5432
- C:\Windows\System\EgCEOzB.exe
  C:\Windows\System\EgCEOzB.exe
  2⤵
  PID:5464
- C:\Windows\System\QdCgsER.exe
  C:\Windows\System\QdCgsER.exe
  2⤵
  PID:5528
- C:\Windows\System\BXaLUzh.exe
  C:\Windows\System\BXaLUzh.exe
  2⤵
  PID:5380
- C:\Windows\System\JHwtcKR.exe
  C:\Windows\System\JHwtcKR.exe
  2⤵
  PID:5476
- C:\Windows\System\mWkMGzX.exe
  C:\Windows\System\mWkMGzX.exe
  2⤵
  PID:5384
- C:\Windows\System\ibEYJKX.exe
  C:\Windows\System\ibEYJKX.exe
  2⤵
  PID:5480
- C:\Windows\System\aGMfpvr.exe
  C:\Windows\System\aGMfpvr.exe
  2⤵
  PID:5576
- C:\Windows\System\uhzAWUY.exe
  C:\Windows\System\uhzAWUY.exe
  2⤵
  PID:5636
- C:\Windows\System\asOtxgT.exe
  C:\Windows\System\asOtxgT.exe
  2⤵
  PID:5700
- C:\Windows\System\qTpwxXD.exe
  C:\Windows\System\qTpwxXD.exe
  2⤵
  PID:5732
- C:\Windows\System\xIYFtDI.exe
  C:\Windows\System\xIYFtDI.exe
  2⤵
  PID:5652
- C:\Windows\System\ppGJNLr.exe
  C:\Windows\System\ppGJNLr.exe
  2⤵
  PID:5716
- C:\Windows\System\vsdbRKn.exe
  C:\Windows\System\vsdbRKn.exe
  2⤵
  PID:5780
- C:\Windows\System\lLUGhyu.exe
  C:\Windows\System\lLUGhyu.exe
  2⤵
  PID:5844
- C:\Windows\System\ruBIfLS.exe
  C:\Windows\System\ruBIfLS.exe
  2⤵
  PID:5828
- C:\Windows\System\ZMNHlwS.exe
  C:\Windows\System\ZMNHlwS.exe
  2⤵
  PID:5908
- C:\Windows\System\iQhYMsT.exe
  C:\Windows\System\iQhYMsT.exe
  2⤵
  PID:5896
- C:\Windows\System\Pqdmrth.exe
  C:\Windows\System\Pqdmrth.exe
  2⤵
  PID:5920
- C:\Windows\System\JdjNmIM.exe
  C:\Windows\System\JdjNmIM.exe
  2⤵
  PID:5972
- C:\Windows\System\zpqQJDg.exe
  C:\Windows\System\zpqQJDg.exe
  2⤵
  PID:6020
- C:\Windows\System\MSMQqZV.exe
  C:\Windows\System\MSMQqZV.exe
  2⤵
  PID:5956
- C:\Windows\System\ikOPJeq.exe
  C:\Windows\System\ikOPJeq.exe
  2⤵
  PID:6068
- C:\Windows\System\uRFQvvs.exe
  C:\Windows\System\uRFQvvs.exe
  2⤵
  PID:6048
- C:\Windows\System\PBeNkpJ.exe
  C:\Windows\System\PBeNkpJ.exe
  2⤵
  PID:6096
- C:\Windows\System\ynzvKwj.exe
  C:\Windows\System\ynzvKwj.exe
  2⤵
  PID:6116
- C:\Windows\System\CFEUDLR.exe
  C:\Windows\System\CFEUDLR.exe
  2⤵
  PID:6132
- C:\Windows\System\qCzrbkP.exe
  C:\Windows\System\qCzrbkP.exe
  2⤵
  PID:4564
- C:\Windows\System\vGHCVtB.exe
  C:\Windows\System\vGHCVtB.exe
  2⤵
  PID:5364
- C:\Windows\System\kwUeMOH.exe
  C:\Windows\System\kwUeMOH.exe
  2⤵
  PID:5560
- C:\Windows\System\wLYgcgB.exe
  C:\Windows\System\wLYgcgB.exe
  2⤵
  PID:5400
- C:\Windows\System\ovmZUUo.exe
  C:\Windows\System\ovmZUUo.exe
  2⤵
  PID:5512
- C:\Windows\System\jfIadxz.exe
  C:\Windows\System\jfIadxz.exe
  2⤵
  PID:5624
- C:\Windows\System\hsFZeed.exe
  C:\Windows\System\hsFZeed.exe
  2⤵
  PID:5764
- C:\Windows\System\rWLgHdG.exe
  C:\Windows\System\rWLgHdG.exe
  2⤵
  PID:5688
- C:\Windows\System\ipzZBfi.exe
  C:\Windows\System\ipzZBfi.exe
  2⤵
  PID:6124
- C:\Windows\System\iiFhmxI.exe
  C:\Windows\System\iiFhmxI.exe
  2⤵
  PID:6032
- C:\Windows\System\EyjABOZ.exe
  C:\Windows\System\EyjABOZ.exe
  2⤵
  PID:5620
- C:\Windows\System\UAqLNqh.exe
  C:\Windows\System\UAqLNqh.exe
  2⤵
  PID:5916
- C:\Windows\System\yoDSCsl.exe
  C:\Windows\System\yoDSCsl.exe
  2⤵
  PID:4544
- C:\Windows\System\MuumpnR.exe
  C:\Windows\System\MuumpnR.exe
  2⤵
  PID:5128
- C:\Windows\System\CsjKywA.exe
  C:\Windows\System\CsjKywA.exe
  2⤵
  PID:5188
- C:\Windows\System\chmdmZc.exe
  C:\Windows\System\chmdmZc.exe
  2⤵
  PID:5204
- C:\Windows\System\odjwozF.exe
  C:\Windows\System\odjwozF.exe
  2⤵
  PID:5288
- C:\Windows\System\aaVoKZy.exe
  C:\Windows\System\aaVoKZy.exe
  2⤵
  PID:5460
- C:\Windows\System\XFNanAP.exe
  C:\Windows\System\XFNanAP.exe
  2⤵
  PID:5496
- C:\Windows\System\dBrjcaD.exe
  C:\Windows\System\dBrjcaD.exe
  2⤵
  PID:2904
- C:\Windows\System\gReizid.exe
  C:\Windows\System\gReizid.exe
  2⤵
  PID:5300
- C:\Windows\System\aIqYuPL.exe
  C:\Windows\System\aIqYuPL.exe
  2⤵
  PID:6064
- C:\Windows\System\ZZxOCMT.exe
  C:\Windows\System\ZZxOCMT.exe
  2⤵
  PID:5124
- C:\Windows\System\btgrMIv.exe
  C:\Windows\System\btgrMIv.exe
  2⤵
  PID:5816
- C:\Windows\System\qQKAsFG.exe
  C:\Windows\System\qQKAsFG.exe
  2⤵
  PID:6112
- C:\Windows\System\LzeEDzk.exe
  C:\Windows\System\LzeEDzk.exe
  2⤵
  PID:5160
- C:\Windows\System\kVMRcSN.exe
  C:\Windows\System\kVMRcSN.exe
  2⤵
  PID:5588
- C:\Windows\System\ZScfbHb.exe
  C:\Windows\System\ZScfbHb.exe
  2⤵
  PID:5812
- C:\Windows\System\VxeVbKY.exe
  C:\Windows\System\VxeVbKY.exe
  2⤵
  PID:5912
- C:\Windows\System\bQmWuVC.exe
  C:\Windows\System\bQmWuVC.exe
  2⤵
  PID:5984
- C:\Windows\System\uhLdouP.exe
  C:\Windows\System\uhLdouP.exe
  2⤵
  PID:4388
- C:\Windows\System\mMINMpk.exe
  C:\Windows\System\mMINMpk.exe
  2⤵
  PID:5608
- C:\Windows\System\XiCcNwW.exe
  C:\Windows\System\XiCcNwW.exe
  2⤵
  PID:5192
- C:\Windows\System\gBVgWaf.exe
  C:\Windows\System\gBVgWaf.exe
  2⤵
  PID:5672
- C:\Windows\System\GBscFGm.exe
  C:\Windows\System\GBscFGm.exe
  2⤵
  PID:6156
- C:\Windows\System\JjZuVWw.exe
  C:\Windows\System\JjZuVWw.exe
  2⤵
  PID:6172
- C:\Windows\System\euwqPuh.exe
  C:\Windows\System\euwqPuh.exe
  2⤵
  PID:6188
- C:\Windows\System\UpTqApz.exe
  C:\Windows\System\UpTqApz.exe
  2⤵
  PID:6204
- C:\Windows\System\GyoUoJb.exe
  C:\Windows\System\GyoUoJb.exe
  2⤵
  PID:6220
- C:\Windows\System\nxGJOwI.exe
  C:\Windows\System\nxGJOwI.exe
  2⤵
  PID:6236
- C:\Windows\System\LAvmbAo.exe
  C:\Windows\System\LAvmbAo.exe
  2⤵
  PID:6252
- C:\Windows\System\tWAXNLP.exe
  C:\Windows\System\tWAXNLP.exe
  2⤵
  PID:6272
- C:\Windows\System\OUomcLK.exe
  C:\Windows\System\OUomcLK.exe
  2⤵
  PID:6288
- C:\Windows\System\YFiIlpk.exe
  C:\Windows\System\YFiIlpk.exe
  2⤵
  PID:6304
- C:\Windows\System\mgOoEoF.exe
  C:\Windows\System\mgOoEoF.exe
  2⤵
  PID:6320
- C:\Windows\System\YIvkPxL.exe
  C:\Windows\System\YIvkPxL.exe
  2⤵
  PID:6336
- C:\Windows\System\akguatc.exe
  C:\Windows\System\akguatc.exe
  2⤵
  PID:6352
- C:\Windows\System\ObEhFHc.exe
  C:\Windows\System\ObEhFHc.exe
  2⤵
  PID:6368
- C:\Windows\System\mogmUiB.exe
  C:\Windows\System\mogmUiB.exe
  2⤵
  PID:6384
- C:\Windows\System\nVfKRiA.exe
  C:\Windows\System\nVfKRiA.exe
  2⤵
  PID:6400
- C:\Windows\System\YlKQpav.exe
  C:\Windows\System\YlKQpav.exe
  2⤵
  PID:6416
- C:\Windows\System\qmeziQm.exe
  C:\Windows\System\qmeziQm.exe
  2⤵
  PID:6432
- C:\Windows\System\rzyFrnm.exe
  C:\Windows\System\rzyFrnm.exe
  2⤵
  PID:6448
- C:\Windows\System\dMdUMuy.exe
  C:\Windows\System\dMdUMuy.exe
  2⤵
  PID:6464
- C:\Windows\System\xSXApmg.exe
  C:\Windows\System\xSXApmg.exe
  2⤵
  PID:6480
- C:\Windows\System\PiKCHOb.exe
  C:\Windows\System\PiKCHOb.exe
  2⤵
  PID:6496
- C:\Windows\System\EJCidtH.exe
  C:\Windows\System\EJCidtH.exe
  2⤵
  PID:6512
- C:\Windows\System\OeOPbjH.exe
  C:\Windows\System\OeOPbjH.exe
  2⤵
  PID:6528
- C:\Windows\System\OzCtLNf.exe
  C:\Windows\System\OzCtLNf.exe
  2⤵
  PID:6544
- C:\Windows\System\gdlRXRe.exe
  C:\Windows\System\gdlRXRe.exe
  2⤵
  PID:6560
- C:\Windows\System\kpVKqSn.exe
  C:\Windows\System\kpVKqSn.exe
  2⤵
  PID:6576
- C:\Windows\System\AkNMhuB.exe
  C:\Windows\System\AkNMhuB.exe
  2⤵
  PID:6592
- C:\Windows\System\gpiIfPI.exe
  C:\Windows\System\gpiIfPI.exe
  2⤵
  PID:6608
- C:\Windows\System\ckSPxSb.exe
  C:\Windows\System\ckSPxSb.exe
  2⤵
  PID:6624
- C:\Windows\System\HckWFCH.exe
  C:\Windows\System\HckWFCH.exe
  2⤵
  PID:6640
- C:\Windows\System\JqUabws.exe
  C:\Windows\System\JqUabws.exe
  2⤵
  PID:6656
- C:\Windows\System\wBAetTr.exe
  C:\Windows\System\wBAetTr.exe
  2⤵
  PID:6672
- C:\Windows\System\BUdrHEA.exe
  C:\Windows\System\BUdrHEA.exe
  2⤵
  PID:6688
- C:\Windows\System\ZlnmxRU.exe
  C:\Windows\System\ZlnmxRU.exe
  2⤵
  PID:6704
- C:\Windows\System\KdUIygJ.exe
  C:\Windows\System\KdUIygJ.exe
  2⤵
  PID:6720
- C:\Windows\System\uryOcnu.exe
  C:\Windows\System\uryOcnu.exe
  2⤵
  PID:6736
- C:\Windows\System\xwydYBx.exe
  C:\Windows\System\xwydYBx.exe
  2⤵
  PID:6752
- C:\Windows\System\dLBfilr.exe
  C:\Windows\System\dLBfilr.exe
  2⤵
  PID:6768
- C:\Windows\System\OAuJwnb.exe
  C:\Windows\System\OAuJwnb.exe
  2⤵
  PID:6784
- C:\Windows\System\BYNVdoC.exe
  C:\Windows\System\BYNVdoC.exe
  2⤵
  PID:6800
- C:\Windows\System\lpAgJhL.exe
  C:\Windows\System\lpAgJhL.exe
  2⤵
  PID:6816
- C:\Windows\System\AHoPwfX.exe
  C:\Windows\System\AHoPwfX.exe
  2⤵
  PID:6832
- C:\Windows\System\msxAdHp.exe
  C:\Windows\System\msxAdHp.exe
  2⤵
  PID:6848
- C:\Windows\System\Pgxtpeu.exe
  C:\Windows\System\Pgxtpeu.exe
  2⤵
  PID:6864
- C:\Windows\System\EkmVaqW.exe
  C:\Windows\System\EkmVaqW.exe
  2⤵
  PID:6880
- C:\Windows\System\wfKjcey.exe
  C:\Windows\System\wfKjcey.exe
  2⤵
  PID:6896
- C:\Windows\System\uvVhdSz.exe
  C:\Windows\System\uvVhdSz.exe
  2⤵
  PID:6912
- C:\Windows\System\nFicfoz.exe
  C:\Windows\System\nFicfoz.exe
  2⤵
  PID:6928
- C:\Windows\System\PaCEOZx.exe
  C:\Windows\System\PaCEOZx.exe
  2⤵
  PID:6944
- C:\Windows\System\UeTBEDT.exe
  C:\Windows\System\UeTBEDT.exe
  2⤵
  PID:6960
- C:\Windows\System\yhQQrSx.exe
  C:\Windows\System\yhQQrSx.exe
  2⤵
  PID:6980
- C:\Windows\System\mYKaCKn.exe
  C:\Windows\System\mYKaCKn.exe
  2⤵
  PID:6996
- C:\Windows\System\dPDIgDF.exe
  C:\Windows\System\dPDIgDF.exe
  2⤵
  PID:7012
- C:\Windows\System\KtqxezX.exe
  C:\Windows\System\KtqxezX.exe
  2⤵
  PID:7080
- C:\Windows\System\GBelaUV.exe
  C:\Windows\System\GBelaUV.exe
  2⤵
  PID:7096
- C:\Windows\System\KujsYUj.exe
  C:\Windows\System\KujsYUj.exe
  2⤵
  PID:7112
- C:\Windows\System\KBijypA.exe
  C:\Windows\System\KBijypA.exe
  2⤵
  PID:7128
- C:\Windows\System\RKVLxnK.exe
  C:\Windows\System\RKVLxnK.exe
  2⤵
  PID:7144
- C:\Windows\System\bisHPSH.exe
  C:\Windows\System\bisHPSH.exe
  2⤵
  PID:7160
- C:\Windows\System\jmmQeyN.exe
  C:\Windows\System\jmmQeyN.exe
  2⤵
  PID:5796
- C:\Windows\System\RFrXutM.exe
  C:\Windows\System\RFrXutM.exe
  2⤵
  PID:6196
- C:\Windows\System\LfuYzan.exe
  C:\Windows\System\LfuYzan.exe
  2⤵
  PID:6260
- C:\Windows\System\MfkAcga.exe
  C:\Windows\System\MfkAcga.exe
  2⤵
  PID:6300
- C:\Windows\System\BZICTCP.exe
  C:\Windows\System\BZICTCP.exe
  2⤵
  PID:6392
- C:\Windows\System\jhsXmPB.exe
  C:\Windows\System\jhsXmPB.exe
  2⤵
  PID:6456
- C:\Windows\System\LAmJUga.exe
  C:\Windows\System\LAmJUga.exe
  2⤵
  PID:6460
- C:\Windows\System\YbxbHWX.exe
  C:\Windows\System\YbxbHWX.exe
  2⤵
  PID:6524
- C:\Windows\System\hwLJZNI.exe
  C:\Windows\System\hwLJZNI.exe
  2⤵
  PID:5892
- C:\Windows\System\roYKGfS.exe
  C:\Windows\System\roYKGfS.exe
  2⤵
  PID:6552
- C:\Windows\System\uyrLWII.exe
  C:\Windows\System\uyrLWII.exe
  2⤵
  PID:6036
- C:\Windows\System\xgaxrmc.exe
  C:\Windows\System\xgaxrmc.exe
  2⤵
  PID:6616
- C:\Windows\System\ASniezd.exe
  C:\Windows\System\ASniezd.exe
  2⤵
  PID:6652
- C:\Windows\System\vlvPQdr.exe
  C:\Windows\System\vlvPQdr.exe
  2⤵
  PID:6716
- C:\Windows\System\qhZwhav.exe
  C:\Windows\System\qhZwhav.exe
  2⤵
  PID:6148
- C:\Windows\System\ZkRSYZz.exe
  C:\Windows\System\ZkRSYZz.exe
  2⤵
  PID:6776
- C:\Windows\System\LtbLGsw.exe
  C:\Windows\System\LtbLGsw.exe
  2⤵
  PID:6780
- C:\Windows\System\OhgHaNc.exe
  C:\Windows\System\OhgHaNc.exe
  2⤵
  PID:6844
- C:\Windows\System\UWbSjhc.exe
  C:\Windows\System\UWbSjhc.exe
  2⤵
  PID:6908
- C:\Windows\System\tpZOnuo.exe
  C:\Windows\System\tpZOnuo.exe
  2⤵
  PID:6568
- C:\Windows\System\UPLbOOf.exe
  C:\Windows\System\UPLbOOf.exe
  2⤵
  PID:6604
- C:\Windows\System\FcbPmBM.exe
  C:\Windows\System\FcbPmBM.exe
  2⤵
  PID:6668
- C:\Windows\System\MPzaett.exe
  C:\Windows\System\MPzaett.exe
  2⤵
  PID:6728
- C:\Windows\System\PeNvLDb.exe
  C:\Windows\System\PeNvLDb.exe
  2⤵
  PID:6760
- C:\Windows\System\koeMAGT.exe
  C:\Windows\System\koeMAGT.exe
  2⤵
  PID:6408
- C:\Windows\System\uakPOwQ.exe
  C:\Windows\System\uakPOwQ.exe
  2⤵
  PID:6888
- C:\Windows\System\dXTapkT.exe
  C:\Windows\System\dXTapkT.exe
  2⤵
  PID:6472
- C:\Windows\System\tXzPnZN.exe
  C:\Windows\System\tXzPnZN.exe
  2⤵
  PID:6920
- C:\Windows\System\xFnEphD.exe
  C:\Windows\System\xFnEphD.exe
  2⤵
  PID:6976
- C:\Windows\System\gLrpCjc.exe
  C:\Windows\System\gLrpCjc.exe
  2⤵
  PID:6992
- C:\Windows\System\aIOwoih.exe
  C:\Windows\System\aIOwoih.exe
  2⤵
  PID:7028
- C:\Windows\System\HFCbrPL.exe
  C:\Windows\System\HFCbrPL.exe
  2⤵
  PID:7044
- C:\Windows\System\piKtabf.exe
  C:\Windows\System\piKtabf.exe
  2⤵
  PID:7060
- C:\Windows\System\zlpEwTB.exe
  C:\Windows\System\zlpEwTB.exe
  2⤵
  PID:7088
- C:\Windows\System\jAIPwEB.exe
  C:\Windows\System\jAIPwEB.exe
  2⤵
  PID:7124
- C:\Windows\System\MFuKkdA.exe
  C:\Windows\System\MFuKkdA.exe
  2⤵
  PID:6268
- C:\Windows\System\ubsefYt.exe
  C:\Windows\System\ubsefYt.exe
  2⤵
  PID:6428
- C:\Windows\System\DyybhrL.exe
  C:\Windows\System\DyybhrL.exe
  2⤵
  PID:6520
- C:\Windows\System\CnSonUr.exe
  C:\Windows\System\CnSonUr.exe
  2⤵
  PID:5252
- C:\Windows\System\fAonrTQ.exe
  C:\Windows\System\fAonrTQ.exe
  2⤵
  PID:6180
- C:\Windows\System\DLTPglT.exe
  C:\Windows\System\DLTPglT.exe
  2⤵
  PID:5540
- C:\Windows\System\axDTLCr.exe
  C:\Windows\System\axDTLCr.exe
  2⤵
  PID:6444
- C:\Windows\System\eeXXcje.exe
  C:\Windows\System\eeXXcje.exe
  2⤵
  PID:6540
- C:\Windows\System\uCsprPl.exe
  C:\Windows\System\uCsprPl.exe
  2⤵
  PID:6380
- C:\Windows\System\QHJxVlI.exe
  C:\Windows\System\QHJxVlI.exe
  2⤵
  PID:6860
- C:\Windows\System\bgwNwca.exe
  C:\Windows\System\bgwNwca.exe
  2⤵
  PID:6360
- C:\Windows\System\arhsQYs.exe
  C:\Windows\System\arhsQYs.exe
  2⤵
  PID:5924
- C:\Windows\System\eQvfKPC.exe
  C:\Windows\System\eQvfKPC.exe
  2⤵
  PID:6648
- C:\Windows\System\LNgMeJc.exe
  C:\Windows\System\LNgMeJc.exe
  2⤵
  PID:6216
- C:\Windows\System\orShNMU.exe
  C:\Windows\System\orShNMU.exe
  2⤵
  PID:6600
- C:\Windows\System\yQxofZV.exe
  C:\Windows\System\yQxofZV.exe
  2⤵
  PID:7036
- C:\Windows\System\jZdSCxT.exe
  C:\Windows\System\jZdSCxT.exe
  2⤵
  PID:7068
- C:\Windows\System\WqSREwk.exe
  C:\Windows\System\WqSREwk.exe
  2⤵
  PID:6164
- C:\Windows\System\PYszFwB.exe
  C:\Windows\System\PYszFwB.exe
  2⤵
  PID:6244
- C:\Windows\System\xfNpcxX.exe
  C:\Windows\System\xfNpcxX.exe
  2⤵
  PID:6796
- C:\Windows\System\VrBGsZR.exe
  C:\Windows\System\VrBGsZR.exe
  2⤵
  PID:7056
- C:\Windows\System\ucvmlEb.exe
  C:\Windows\System\ucvmlEb.exe
  2⤵
  PID:7104
- C:\Windows\System\DkoZaxm.exe
  C:\Windows\System\DkoZaxm.exe
  2⤵
  PID:6840
- C:\Windows\System\gERFvlq.exe
  C:\Windows\System\gERFvlq.exe
  2⤵
  PID:7140
- C:\Windows\System\VWwkfHt.exe
  C:\Windows\System\VWwkfHt.exe
  2⤵
  PID:6508
- C:\Windows\System\HhZjMKh.exe
  C:\Windows\System\HhZjMKh.exe
  2⤵
  PID:7004
- C:\Windows\System\uqYwNbO.exe
  C:\Windows\System\uqYwNbO.exe
  2⤵
  PID:6968
- C:\Windows\System\dAYRqyE.exe
  C:\Windows\System\dAYRqyE.exe
  2⤵
  PID:6856
- C:\Windows\System\KStvBSh.exe
  C:\Windows\System\KStvBSh.exe
  2⤵
  PID:6212
- C:\Windows\System\pPToWiq.exe
  C:\Windows\System\pPToWiq.exe
  2⤵
  PID:7024
- C:\Windows\System\ozPuyfj.exe
  C:\Windows\System\ozPuyfj.exe
  2⤵
  PID:7120
- C:\Windows\System\dmGDCAN.exe
  C:\Windows\System\dmGDCAN.exe
  2⤵
  PID:6440
- C:\Windows\System\pExgIrB.exe
  C:\Windows\System\pExgIrB.exe
  2⤵
  PID:6684
- C:\Windows\System\LXjWBnd.exe
  C:\Windows\System\LXjWBnd.exe
  2⤵
  PID:6376
- C:\Windows\System\KsDnaor.exe
  C:\Windows\System\KsDnaor.exe
  2⤵
  PID:6424
- C:\Windows\System\demdIUH.exe
  C:\Windows\System\demdIUH.exe
  2⤵
  PID:5444
- C:\Windows\System\yfjGSrJ.exe
  C:\Windows\System\yfjGSrJ.exe
  2⤵
  PID:6828
- C:\Windows\System\kBHjYWT.exe
  C:\Windows\System\kBHjYWT.exe
  2⤵
  PID:7184
- C:\Windows\System\XrDUIOU.exe
  C:\Windows\System\XrDUIOU.exe
  2⤵
  PID:7200
- C:\Windows\System\QqGLWXh.exe
  C:\Windows\System\QqGLWXh.exe
  2⤵
  PID:7308
- C:\Windows\System\pyYnUmT.exe
  C:\Windows\System\pyYnUmT.exe
  2⤵
  PID:7328
- C:\Windows\System\xblWEDO.exe
  C:\Windows\System\xblWEDO.exe
  2⤵
  PID:7344
- C:\Windows\System\ViLtoQa.exe
  C:\Windows\System\ViLtoQa.exe
  2⤵
  PID:7364
- C:\Windows\System\SXVakFX.exe
  C:\Windows\System\SXVakFX.exe
  2⤵
  PID:7380
- C:\Windows\System\UKbDJpR.exe
  C:\Windows\System\UKbDJpR.exe
  2⤵
  PID:7396
- C:\Windows\System\nkKhYcb.exe
  C:\Windows\System\nkKhYcb.exe
  2⤵
  PID:7412
- C:\Windows\System\iMVSusb.exe
  C:\Windows\System\iMVSusb.exe
  2⤵
  PID:7428
- C:\Windows\System\lRdRHoj.exe
  C:\Windows\System\lRdRHoj.exe
  2⤵
  PID:7444
- C:\Windows\System\IMcgHAQ.exe
  C:\Windows\System\IMcgHAQ.exe
  2⤵
  PID:7460
- C:\Windows\System\CTnibRp.exe
  C:\Windows\System\CTnibRp.exe
  2⤵
  PID:7476
- C:\Windows\System\GaDCjiy.exe
  C:\Windows\System\GaDCjiy.exe
  2⤵
  PID:7492
- C:\Windows\System\YMhBDMf.exe
  C:\Windows\System\YMhBDMf.exe
  2⤵
  PID:7508
- C:\Windows\System\mBIpWoE.exe
  C:\Windows\System\mBIpWoE.exe
  2⤵
  PID:7524
- C:\Windows\System\KdSFZEm.exe
  C:\Windows\System\KdSFZEm.exe
  2⤵
  PID:7540
- C:\Windows\System\yBXsHoV.exe
  C:\Windows\System\yBXsHoV.exe
  2⤵
  PID:7556
- C:\Windows\System\ojIFYwh.exe
  C:\Windows\System\ojIFYwh.exe
  2⤵
  PID:7572
- C:\Windows\System\lolQtdv.exe
  C:\Windows\System\lolQtdv.exe
  2⤵
  PID:7592
- C:\Windows\System\zhCqfUA.exe
  C:\Windows\System\zhCqfUA.exe
  2⤵
  PID:7616
- C:\Windows\System\PjQoZRb.exe
  C:\Windows\System\PjQoZRb.exe
  2⤵
  PID:7632
- C:\Windows\System\MQwyUcr.exe
  C:\Windows\System\MQwyUcr.exe
  2⤵
  PID:7648
- C:\Windows\System\QUDAZkG.exe
  C:\Windows\System\QUDAZkG.exe
  2⤵
  PID:7664
- C:\Windows\System\vrjnDwW.exe
  C:\Windows\System\vrjnDwW.exe
  2⤵
  PID:7680
- C:\Windows\System\KLqldlm.exe
  C:\Windows\System\KLqldlm.exe
  2⤵
  PID:7696
- C:\Windows\System\sxHgaWs.exe
  C:\Windows\System\sxHgaWs.exe
  2⤵
  PID:7712
- C:\Windows\System\yUBirze.exe
  C:\Windows\System\yUBirze.exe
  2⤵
  PID:7728
- C:\Windows\System\HQWgQso.exe
  C:\Windows\System\HQWgQso.exe
  2⤵
  PID:7744
- C:\Windows\System\ceiqAFc.exe
  C:\Windows\System\ceiqAFc.exe
  2⤵
  PID:7760
- C:\Windows\System\vsquLsx.exe
  C:\Windows\System\vsquLsx.exe
  2⤵
  PID:7776
- C:\Windows\System\SoKOAGw.exe
  C:\Windows\System\SoKOAGw.exe
  2⤵
  PID:7792
- C:\Windows\System\rSGlZJu.exe
  C:\Windows\System\rSGlZJu.exe
  2⤵
  PID:7808
- C:\Windows\System\gGIylss.exe
  C:\Windows\System\gGIylss.exe
  2⤵
  PID:7824
- C:\Windows\System\NPULZAR.exe
  C:\Windows\System\NPULZAR.exe
  2⤵
  PID:7840
- C:\Windows\System\KAvupYK.exe
  C:\Windows\System\KAvupYK.exe
  2⤵
  PID:7856
- C:\Windows\System\mRdkhbX.exe
  C:\Windows\System\mRdkhbX.exe
  2⤵
  PID:7872
- C:\Windows\System\oUcbgbi.exe
  C:\Windows\System\oUcbgbi.exe
  2⤵
  PID:7888
- C:\Windows\System\JekKGKk.exe
  C:\Windows\System\JekKGKk.exe
  2⤵
  PID:7904
- C:\Windows\System\fJpeLeY.exe
  C:\Windows\System\fJpeLeY.exe
  2⤵
  PID:7920
- C:\Windows\System\wsVNUyh.exe
  C:\Windows\System\wsVNUyh.exe
  2⤵
  PID:7936
- C:\Windows\System\cxknyMs.exe
  C:\Windows\System\cxknyMs.exe
  2⤵
  PID:7952
- C:\Windows\System\KBbcjnd.exe
  C:\Windows\System\KBbcjnd.exe
  2⤵
  PID:7968
- C:\Windows\System\nmzcNSa.exe
  C:\Windows\System\nmzcNSa.exe
  2⤵
  PID:7984
- C:\Windows\System\DotZtza.exe
  C:\Windows\System\DotZtza.exe
  2⤵
  PID:8000
- C:\Windows\System\tfepXWq.exe
  C:\Windows\System\tfepXWq.exe
  2⤵
  PID:8016
- C:\Windows\System\FDIealH.exe
  C:\Windows\System\FDIealH.exe
  2⤵
  PID:8032
- C:\Windows\System\anirpkJ.exe
  C:\Windows\System\anirpkJ.exe
  2⤵
  PID:8048
- C:\Windows\System\PDWrRRZ.exe
  C:\Windows\System\PDWrRRZ.exe
  2⤵
  PID:8172
- C:\Windows\System\kJZGBPh.exe
  C:\Windows\System\kJZGBPh.exe
  2⤵
  PID:8188
- C:\Windows\System\NQwnISi.exe
  C:\Windows\System\NQwnISi.exe
  2⤵
  PID:7208
- C:\Windows\System\APmTejg.exe
  C:\Windows\System\APmTejg.exe
  2⤵
  PID:7196
- C:\Windows\System\imDcgPx.exe
  C:\Windows\System\imDcgPx.exe
  2⤵
  PID:7212
- C:\Windows\System\rxllsdm.exe
  C:\Windows\System\rxllsdm.exe
  2⤵
  PID:7232
- C:\Windows\System\hEJAlrF.exe
  C:\Windows\System\hEJAlrF.exe
  2⤵
  PID:7248
- C:\Windows\System\qbhlHng.exe
  C:\Windows\System\qbhlHng.exe
  2⤵
  PID:7756
- C:\Windows\System\zMxYRtL.exe
  C:\Windows\System\zMxYRtL.exe
  2⤵
  PID:7820
- C:\Windows\System\XYMBkyR.exe
  C:\Windows\System\XYMBkyR.exe
  2⤵
  PID:7916
- C:\Windows\System\CeEVlSU.exe
  C:\Windows\System\CeEVlSU.exe
  2⤵
  PID:7304
- C:\Windows\System\FVrFRkj.exe
  C:\Windows\System\FVrFRkj.exe
  2⤵
  PID:8012
- C:\Windows\System\eaJWWDx.exe
  C:\Windows\System\eaJWWDx.exe
  2⤵
  PID:8040
- C:\Windows\System\spwGTcG.exe
  C:\Windows\System\spwGTcG.exe
  2⤵
  PID:7468
- C:\Windows\System\CDWytNj.exe
  C:\Windows\System\CDWytNj.exe
  2⤵
  PID:7408
- C:\Windows\System\OAXbtIM.exe
  C:\Windows\System\OAXbtIM.exe
  2⤵
  PID:7340
- C:\Windows\System\eusppde.exe
  C:\Windows\System\eusppde.exe
  2⤵
  PID:7676
- C:\Windows\System\rmHPxIE.exe
  C:\Windows\System\rmHPxIE.exe
  2⤵
  PID:7564
- C:\Windows\System\gkgKRWn.exe
  C:\Windows\System\gkgKRWn.exe
  2⤵
  PID:7900
- C:\Windows\System\xgcyPcm.exe
  C:\Windows\System\xgcyPcm.exe
  2⤵
  PID:7612
- C:\Windows\System\HRmHGSA.exe
  C:\Windows\System\HRmHGSA.exe
  2⤵
  PID:7768
- C:\Windows\System\lpHRwCb.exe
  C:\Windows\System\lpHRwCb.exe
  2⤵
  PID:7836
- C:\Windows\System\OzCsSLn.exe
  C:\Windows\System\OzCsSLn.exe
  2⤵
  PID:7604
- C:\Windows\System\VyULOQX.exe
  C:\Windows\System\VyULOQX.exe
  2⤵
  PID:8056
- C:\Windows\System\oAjEotd.exe
  C:\Windows\System\oAjEotd.exe
  2⤵
  PID:8072
- C:\Windows\System\OqfCExB.exe
  C:\Windows\System\OqfCExB.exe
  2⤵
  PID:8088
- C:\Windows\System\UefmnCo.exe
  C:\Windows\System\UefmnCo.exe
  2⤵
  PID:8104
- C:\Windows\System\WbIGpfS.exe
  C:\Windows\System\WbIGpfS.exe
  2⤵
  PID:8124
- C:\Windows\System\CxBDbEj.exe
  C:\Windows\System\CxBDbEj.exe
  2⤵
  PID:8140
- C:\Windows\System\xLqbfCe.exe
  C:\Windows\System\xLqbfCe.exe
  2⤵
  PID:8160
- C:\Windows\System\cYtEaYI.exe
  C:\Windows\System\cYtEaYI.exe
  2⤵
  PID:7180
- C:\Windows\System\omqlFAz.exe
  C:\Windows\System\omqlFAz.exe
  2⤵
  PID:6940
- C:\Windows\System\ZZXiFXI.exe
  C:\Windows\System\ZZXiFXI.exe
  2⤵
  PID:7240
- C:\Windows\System\CkTeGaM.exe
  C:\Windows\System\CkTeGaM.exe
  2⤵
  PID:7260
- C:\Windows\System\CAASQHn.exe
  C:\Windows\System\CAASQHn.exe
  2⤵
  PID:7880
- C:\Windows\System\sxAVCWg.exe
  C:\Windows\System\sxAVCWg.exe
  2⤵
  PID:7708
- C:\Windows\System\PDpSFPm.exe
  C:\Windows\System\PDpSFPm.exe
  2⤵
  PID:7816
- C:\Windows\System\fMBCkbb.exe
  C:\Windows\System\fMBCkbb.exe
  2⤵
  PID:7640
- C:\Windows\System\SCkBeIj.exe
  C:\Windows\System\SCkBeIj.exe
  2⤵
  PID:8024
- C:\Windows\System\wcCDzIC.exe
  C:\Windows\System\wcCDzIC.exe
  2⤵
  PID:8080
- C:\Windows\System\QbNmPfM.exe
  C:\Windows\System\QbNmPfM.exe
  2⤵
  PID:7536
- C:\Windows\System\SkAbMaa.exe
  C:\Windows\System\SkAbMaa.exe
  2⤵
  PID:7832
- C:\Windows\System\PhFqpnE.exe
  C:\Windows\System\PhFqpnE.exe
  2⤵
  PID:7928
- C:\Windows\System\JbyHsDj.exe
  C:\Windows\System\JbyHsDj.exe
  2⤵
  PID:8100
- C:\Windows\System\dWwkuUc.exe
  C:\Windows\System\dWwkuUc.exe
  2⤵
  PID:8132
- C:\Windows\System\HAZMrMi.exe
  C:\Windows\System\HAZMrMi.exe
  2⤵
  PID:7152
- C:\Windows\System\tZehmmT.exe
  C:\Windows\System\tZehmmT.exe
  2⤵
  PID:8136
- C:\Windows\System\Prwnysm.exe
  C:\Windows\System\Prwnysm.exe
  2⤵
  PID:6248
- C:\Windows\System\UEJcpnp.exe
  C:\Windows\System\UEJcpnp.exe
  2⤵
  PID:8168
- C:\Windows\System\yHTpMMI.exe
  C:\Windows\System\yHTpMMI.exe
  2⤵
  PID:7320
- C:\Windows\System\CxUtfFC.exe
  C:\Windows\System\CxUtfFC.exe
  2⤵
  PID:7388
- C:\Windows\System\OSfEpGb.exe
  C:\Windows\System\OSfEpGb.exe
  2⤵
  PID:7456
- C:\Windows\System\NIoJRAH.exe
  C:\Windows\System\NIoJRAH.exe
  2⤵
  PID:7300
- C:\Windows\System\nKfNQOX.exe
  C:\Windows\System\nKfNQOX.exe
  2⤵
  PID:7580
- C:\Windows\System\jYkIfWU.exe
  C:\Windows\System\jYkIfWU.exe
  2⤵
  PID:7488
- C:\Windows\System\PHVbwFX.exe
  C:\Windows\System\PHVbwFX.exe
  2⤵
  PID:7656
- C:\Windows\System\wMaadVM.exe
  C:\Windows\System\wMaadVM.exe
  2⤵
  PID:7752
- C:\Windows\System\gLLghaE.exe
  C:\Windows\System\gLLghaE.exe
  2⤵
  PID:7804
- C:\Windows\System\sFcPLBf.exe
  C:\Windows\System\sFcPLBf.exe
  2⤵
  PID:7440
- C:\Windows\System\oihSLYk.exe
  C:\Windows\System\oihSLYk.exe
  2⤵
  PID:6140
- C:\Windows\System\yNcrWah.exe
  C:\Windows\System\yNcrWah.exe
  2⤵
  PID:7276
- C:\Windows\System\mliSCoY.exe
  C:\Windows\System\mliSCoY.exe
  2⤵
  PID:7420
- C:\Windows\System\KzcDWmq.exe
  C:\Windows\System\KzcDWmq.exe
  2⤵
  PID:7296
- C:\Windows\System\dtlXfaL.exe
  C:\Windows\System\dtlXfaL.exe
  2⤵
  PID:8008
- C:\Windows\System\cJqpULe.exe
  C:\Windows\System\cJqpULe.exe
  2⤵
  PID:8152
- C:\Windows\System\ieIsjQE.exe
  C:\Windows\System\ieIsjQE.exe
  2⤵
  PID:7800
- C:\Windows\System\XuKzWKv.exe
  C:\Windows\System\XuKzWKv.exe
  2⤵
  PID:7336
- C:\Windows\System\cPqjUhi.exe
  C:\Windows\System\cPqjUhi.exe
  2⤵
  PID:7516
- C:\Windows\System\nYboYkh.exe
  C:\Windows\System\nYboYkh.exe
  2⤵
  PID:7224
- C:\Windows\System\eJgYHOy.exe
  C:\Windows\System\eJgYHOy.exe
  2⤵
  PID:7292
- C:\Windows\System\NlHbOqt.exe
  C:\Windows\System\NlHbOqt.exe
  2⤵
  PID:7316
- C:\Windows\System\JWISyLl.exe
  C:\Windows\System\JWISyLl.exe
  2⤵
  PID:7244
- C:\Windows\System\kwMRttu.exe
  C:\Windows\System\kwMRttu.exe
  2⤵
  PID:1496
- C:\Windows\System\exKtxfD.exe
  C:\Windows\System\exKtxfD.exe
  2⤵
  PID:8084
- C:\Windows\System\owiRLHh.exe
  C:\Windows\System\owiRLHh.exe
  2⤵
  PID:7360
- C:\Windows\System\uSGydDD.exe
  C:\Windows\System\uSGydDD.exe
  2⤵
  PID:8208
- C:\Windows\System\wrCHMGd.exe
  C:\Windows\System\wrCHMGd.exe
  2⤵
  PID:8224
- C:\Windows\System\wUgnoQP.exe
  C:\Windows\System\wUgnoQP.exe
  2⤵
  PID:8240
- C:\Windows\System\IozotoR.exe
  C:\Windows\System\IozotoR.exe
  2⤵
  PID:8256
- C:\Windows\System\NvSQdUD.exe
  C:\Windows\System\NvSQdUD.exe
  2⤵
  PID:8272
- C:\Windows\System\BuSQIJl.exe
  C:\Windows\System\BuSQIJl.exe
  2⤵
  PID:8372
- C:\Windows\System\jVwOzPU.exe
  C:\Windows\System\jVwOzPU.exe
  2⤵
  PID:8388
- C:\Windows\System\WzafZBS.exe
  C:\Windows\System\WzafZBS.exe
  2⤵
  PID:8408
- C:\Windows\System\adxugnY.exe
  C:\Windows\System\adxugnY.exe
  2⤵
  PID:8424
- C:\Windows\System\cxSMIJm.exe
  C:\Windows\System\cxSMIJm.exe
  2⤵
  PID:8444
- C:\Windows\System\rGxEQZY.exe
  C:\Windows\System\rGxEQZY.exe
  2⤵
  PID:8464
- C:\Windows\System\DowyhKe.exe
  C:\Windows\System\DowyhKe.exe
  2⤵
  PID:8480
- C:\Windows\System\UscSjPf.exe
  C:\Windows\System\UscSjPf.exe
  2⤵
  PID:8496
- C:\Windows\System\trOzaVy.exe
  C:\Windows\System\trOzaVy.exe
  2⤵
  PID:8512
- C:\Windows\System\DczacfW.exe
  C:\Windows\System\DczacfW.exe
  2⤵
  PID:8528
- C:\Windows\System\BQzOPca.exe
  C:\Windows\System\BQzOPca.exe
  2⤵
  PID:8544
- C:\Windows\System\NtycCUo.exe
  C:\Windows\System\NtycCUo.exe
  2⤵
  PID:8560
- C:\Windows\System\MYHmADz.exe
  C:\Windows\System\MYHmADz.exe
  2⤵
  PID:8576
- C:\Windows\System\nVcfome.exe
  C:\Windows\System\nVcfome.exe
  2⤵
  PID:8592
- C:\Windows\System\RXmLHvV.exe
  C:\Windows\System\RXmLHvV.exe
  2⤵
  PID:8608
- C:\Windows\System\QMPUllA.exe
  C:\Windows\System\QMPUllA.exe
  2⤵
  PID:8636
- C:\Windows\System\gOGkCsZ.exe
  C:\Windows\System\gOGkCsZ.exe
  2⤵
  PID:8652
- C:\Windows\System\meZlDtq.exe
  C:\Windows\System\meZlDtq.exe
  2⤵
  PID:8668
- C:\Windows\System\JbEKvpz.exe
  C:\Windows\System\JbEKvpz.exe
  2⤵
  PID:8688
- C:\Windows\System\nhQjcpz.exe
  C:\Windows\System\nhQjcpz.exe
  2⤵
  PID:8704
- C:\Windows\System\ZGAFIiG.exe
  C:\Windows\System\ZGAFIiG.exe
  2⤵
  PID:8720
- C:\Windows\System\xfEbzQs.exe
  C:\Windows\System\xfEbzQs.exe
  2⤵
  PID:8740
- C:\Windows\System\hlAZSVv.exe
  C:\Windows\System\hlAZSVv.exe
  2⤵
  PID:8756
- C:\Windows\System\FShtyID.exe
  C:\Windows\System\FShtyID.exe
  2⤵
  PID:8772
- C:\Windows\System\SnYBEcR.exe
  C:\Windows\System\SnYBEcR.exe
  2⤵
  PID:8788
- C:\Windows\System\JsKZqzR.exe
  C:\Windows\System\JsKZqzR.exe
  2⤵
  PID:8804
- C:\Windows\System\JhTcQIJ.exe
  C:\Windows\System\JhTcQIJ.exe
  2⤵
  PID:8820
- C:\Windows\System\QxLFTYY.exe
  C:\Windows\System\QxLFTYY.exe
  2⤵
  PID:8836
- C:\Windows\System\aNpncDB.exe
  C:\Windows\System\aNpncDB.exe
  2⤵
  PID:8852
- C:\Windows\System\Ecvtqpt.exe
  C:\Windows\System\Ecvtqpt.exe
  2⤵
  PID:8868
- C:\Windows\System\DWcFuOv.exe
  C:\Windows\System\DWcFuOv.exe
  2⤵
  PID:8884
- C:\Windows\System\vXdmLyU.exe
  C:\Windows\System\vXdmLyU.exe
  2⤵
  PID:8900
- C:\Windows\System\tTyHXqe.exe
  C:\Windows\System\tTyHXqe.exe
  2⤵
  PID:8916
- C:\Windows\System\EfWAueD.exe
  C:\Windows\System\EfWAueD.exe
  2⤵
  PID:8932
- C:\Windows\System\BufJkNI.exe
  C:\Windows\System\BufJkNI.exe
  2⤵
  PID:8948
- C:\Windows\System\bTtSrHy.exe
  C:\Windows\System\bTtSrHy.exe
  2⤵
  PID:8964
- C:\Windows\System\HoiBSlh.exe
  C:\Windows\System\HoiBSlh.exe
  2⤵
  PID:8980
- C:\Windows\System\QphdsYi.exe
  C:\Windows\System\QphdsYi.exe
  2⤵
  PID:9072
- C:\Windows\System\VuIjhkC.exe
  C:\Windows\System\VuIjhkC.exe
  2⤵
  PID:8252
- C:\Windows\System\JwZLeIw.exe
  C:\Windows\System\JwZLeIw.exe
  2⤵
  PID:8488
- C:\Windows\System\laVXNdr.exe
  C:\Windows\System\laVXNdr.exe
  2⤵
  PID:8504
- C:\Windows\System\BEffuJH.exe
  C:\Windows\System\BEffuJH.exe
  2⤵
  PID:8552
- C:\Windows\System\oaQwXPR.exe
  C:\Windows\System\oaQwXPR.exe
  2⤵
  PID:8572
- C:\Windows\System\RfhlKzJ.exe
  C:\Windows\System\RfhlKzJ.exe
  2⤵
  PID:8620
- C:\Windows\System\zfZILAN.exe
  C:\Windows\System\zfZILAN.exe
  2⤵
  PID:8664
- C:\Windows\System\oAatFWQ.exe
  C:\Windows\System\oAatFWQ.exe
  2⤵
  PID:8700
- C:\Windows\System\CitpQuw.exe
  C:\Windows\System\CitpQuw.exe
  2⤵
  PID:8736
- C:\Windows\System\qgYxEcq.exe
  C:\Windows\System\qgYxEcq.exe
  2⤵
  PID:8796
- C:\Windows\System\drzHorX.exe
  C:\Windows\System\drzHorX.exe
  2⤵
  PID:8680
- C:\Windows\System\VSYrkKq.exe
  C:\Windows\System\VSYrkKq.exe
  2⤵
  PID:8644
- C:\Windows\System\EiODsHC.exe
  C:\Windows\System\EiODsHC.exe
  2⤵
  PID:8812
- C:\Windows\System\nXWvLxw.exe
  C:\Windows\System\nXWvLxw.exe
  2⤵
  PID:8896
- C:\Windows\System\SgTygZP.exe
  C:\Windows\System\SgTygZP.exe
  2⤵
  PID:8960
- C:\Windows\System\UXPCCnQ.exe
  C:\Windows\System\UXPCCnQ.exe
  2⤵
  PID:8908
- C:\Windows\System\qVuLxqo.exe
  C:\Windows\System\qVuLxqo.exe
  2⤵
  PID:8880
- C:\Windows\System\xzqtMyb.exe
  C:\Windows\System\xzqtMyb.exe
  2⤵
  PID:8992
- C:\Windows\System\KAcXsKV.exe
  C:\Windows\System\KAcXsKV.exe
  2⤵
  PID:9008
- C:\Windows\System\KJxGsCM.exe
  C:\Windows\System\KJxGsCM.exe
  2⤵
  PID:9024
- C:\Windows\System\ZMvcWLX.exe
  C:\Windows\System\ZMvcWLX.exe
  2⤵
  PID:9044
- C:\Windows\System\jeSYoDn.exe
  C:\Windows\System\jeSYoDn.exe
  2⤵
  PID:9064
- C:\Windows\System\DdjIWqD.exe
  C:\Windows\System\DdjIWqD.exe
  2⤵
  PID:9092
- C:\Windows\System\eworxgk.exe
  C:\Windows\System\eworxgk.exe
  2⤵
  PID:9108
- C:\Windows\System\KwiNyNz.exe
  C:\Windows\System\KwiNyNz.exe
  2⤵
  PID:9124
- C:\Windows\System\GEJrQYI.exe
  C:\Windows\System\GEJrQYI.exe
  2⤵
  PID:9152
- C:\Windows\System\xadsdjK.exe
  C:\Windows\System\xadsdjK.exe
  2⤵
  PID:9144
- C:\Windows\System\zjWeQLK.exe
  C:\Windows\System\zjWeQLK.exe
  2⤵
  PID:9176
- C:\Windows\System\eYGLxDj.exe
  C:\Windows\System\eYGLxDj.exe
  2⤵
  PID:9188
- C:\Windows\System\qWrLPoB.exe
  C:\Windows\System\qWrLPoB.exe
  2⤵
  PID:9208
- C:\Windows\System\iSmjuPX.exe
  C:\Windows\System\iSmjuPX.exe
  2⤵
  PID:8204
- C:\Windows\System\zgPllGf.exe
  C:\Windows\System\zgPllGf.exe
  2⤵
  PID:8268
- C:\Windows\System\zEweTOg.exe
  C:\Windows\System\zEweTOg.exe
  2⤵
  PID:7740
- C:\Windows\System\dDfnwxA.exe
  C:\Windows\System\dDfnwxA.exe
  2⤵
  PID:7992
- C:\Windows\System\WqlyyCv.exe
  C:\Windows\System\WqlyyCv.exe
  2⤵
  PID:7520
- C:\Windows\System\vhYLCbK.exe
  C:\Windows\System\vhYLCbK.exe
  2⤵
  PID:8220
- C:\Windows\System\QwzFfSt.exe
  C:\Windows\System\QwzFfSt.exe
  2⤵
  PID:8292
- C:\Windows\System\ArIwkuJ.exe
  C:\Windows\System\ArIwkuJ.exe
  2⤵
  PID:8308
- C:\Windows\System\sxxElhk.exe
  C:\Windows\System\sxxElhk.exe
  2⤵
  PID:8324
- C:\Windows\System\KJZdVFU.exe
  C:\Windows\System\KJZdVFU.exe
  2⤵
  PID:8352
- C:\Windows\System\qTjbmDF.exe
  C:\Windows\System\qTjbmDF.exe
  2⤵
  PID:8404
- C:\Windows\System\CQQGQgl.exe
  C:\Windows\System\CQQGQgl.exe
  2⤵
  PID:8436
- C:\Windows\System\kKiayyh.exe
  C:\Windows\System\kKiayyh.exe
  2⤵
  PID:8456
- C:\Windows\System\SsXYOOU.exe
  C:\Windows\System\SsXYOOU.exe
  2⤵
  PID:8472
- C:\Windows\System\jraRjPI.exe
  C:\Windows\System\jraRjPI.exe
  2⤵
  PID:8524
- C:\Windows\System\TJBiFFO.exe
  C:\Windows\System\TJBiFFO.exe
  2⤵
  PID:8632
- C:\Windows\System\eHVbqFK.exe
  C:\Windows\System\eHVbqFK.exe
  2⤵
  PID:8568
- C:\Windows\System\ygGaCxW.exe
  C:\Windows\System\ygGaCxW.exe
  2⤵
  PID:8684
- C:\Windows\System\LCKqYMu.exe
  C:\Windows\System\LCKqYMu.exe
  2⤵
  PID:8752
- C:\Windows\System\NefOobh.exe
  C:\Windows\System\NefOobh.exe
  2⤵
  PID:8780
- C:\Windows\System\AXddUbx.exe
  C:\Windows\System\AXddUbx.exe
  2⤵
  PID:9100
- C:\Windows\System\ogyYmPj.exe
  C:\Windows\System\ogyYmPj.exe
  2⤵
  PID:9136
- C:\Windows\System\pkLATcf.exe
  C:\Windows\System\pkLATcf.exe
  2⤵
  PID:9200
- C:\Windows\System\rPaMsrz.exe
  C:\Windows\System\rPaMsrz.exe
  2⤵
  PID:9148
- C:\Windows\System\YmZZTuH.exe
  C:\Windows\System\YmZZTuH.exe
  2⤵
  PID:9120
- C:\Windows\System\rpswJXF.exe
  C:\Windows\System\rpswJXF.exe
  2⤵
  PID:9140
- C:\Windows\System\wmHdFTm.exe
  C:\Windows\System\wmHdFTm.exe
  2⤵
  PID:8460
- C:\Windows\System\lYtFVcI.exe
  C:\Windows\System\lYtFVcI.exe
  2⤵
  PID:8348
- C:\Windows\System\LsUSkrT.exe
  C:\Windows\System\LsUSkrT.exe
  2⤵
  PID:9180
- C:\Windows\System\WnDFtJR.exe
  C:\Windows\System\WnDFtJR.exe
  2⤵
  PID:8696
- C:\Windows\System\iHVdeaz.exe
  C:\Windows\System\iHVdeaz.exe
  2⤵
  PID:8284
- C:\Windows\System\krMFDhZ.exe
  C:\Windows\System\krMFDhZ.exe
  2⤵
  PID:9184
- C:\Windows\System\rCTvStX.exe
  C:\Windows\System\rCTvStX.exe
  2⤵
  PID:8288
- C:\Windows\System\bOLMxpp.exe
  C:\Windows\System\bOLMxpp.exe
  2⤵
  PID:8320
- C:\Windows\System\EcuDCLE.exe
  C:\Windows\System\EcuDCLE.exe
  2⤵
  PID:8368
- C:\Windows\System\uObJXOF.exe
  C:\Windows\System\uObJXOF.exe
  2⤵
  PID:8972
- C:\Windows\System\OJplunF.exe
  C:\Windows\System\OJplunF.exe
  2⤵
  PID:8928
- C:\Windows\System\lFEGZqB.exe
  C:\Windows\System\lFEGZqB.exe
  2⤵
  PID:8976
- C:\Windows\System\CRzkjMh.exe
  C:\Windows\System\CRzkjMh.exe
  2⤵
  PID:9052
- C:\Windows\System\uOSdUxO.exe
  C:\Windows\System\uOSdUxO.exe
  2⤵
  PID:9168
- C:\Windows\System\neqbgeL.exe
  C:\Windows\System\neqbgeL.exe
  2⤵
  PID:8216
- C:\Windows\System\RUJnwsU.exe
  C:\Windows\System\RUJnwsU.exe
  2⤵
  PID:8728
- C:\Windows\System\LtITkWe.exe
  C:\Windows\System\LtITkWe.exe
  2⤵
  PID:8416
- C:\Windows\System\NdGqeOS.exe
  C:\Windows\System\NdGqeOS.exe
  2⤵
  PID:8784
- C:\Windows\System\vJFWvQC.exe
  C:\Windows\System\vJFWvQC.exe
  2⤵
  PID:8280
- C:\Windows\System\bKhSOir.exe
  C:\Windows\System\bKhSOir.exe
  2⤵
  PID:8628
- C:\Windows\System\DPSoZbJ.exe
  C:\Windows\System\DPSoZbJ.exe
  2⤵
  PID:7392
- C:\Windows\System\PSEwtyU.exe
  C:\Windows\System\PSEwtyU.exe
  2⤵
  PID:9016
- C:\Windows\System\MaKzlZm.exe
  C:\Windows\System\MaKzlZm.exe
  2⤵
  PID:8264
- C:\Windows\System\cStuJEy.exe
  C:\Windows\System\cStuJEy.exe
  2⤵
  PID:9204
- C:\Windows\System\qBPsnwX.exe
  C:\Windows\System\qBPsnwX.exe
  2⤵
  PID:8360
- C:\Windows\System\oZYjqSh.exe
  C:\Windows\System\oZYjqSh.exe
  2⤵
  PID:8876
- C:\Windows\System\AHlBgCH.exe
  C:\Windows\System\AHlBgCH.exe
  2⤵
  PID:8660
- C:\Windows\System\NVJvsmH.exe
  C:\Windows\System\NVJvsmH.exe
  2⤵
  PID:9236
- C:\Windows\System\slLZdzF.exe
  C:\Windows\System\slLZdzF.exe
  2⤵
  PID:9252
- C:\Windows\System\rxPLEJD.exe
  C:\Windows\System\rxPLEJD.exe
  2⤵
  PID:9268
- C:\Windows\System\VlCXVpu.exe
  C:\Windows\System\VlCXVpu.exe
  2⤵
  PID:9284
- C:\Windows\System\mmXVqrL.exe
  C:\Windows\System\mmXVqrL.exe
  2⤵
  PID:9300
- C:\Windows\System\fgNwCjk.exe
  C:\Windows\System\fgNwCjk.exe
  2⤵
  PID:9316
- C:\Windows\System\cySMIHr.exe
  C:\Windows\System\cySMIHr.exe
  2⤵
  PID:9332
- C:\Windows\System\MqysgHm.exe
  C:\Windows\System\MqysgHm.exe
  2⤵
  PID:9348
- C:\Windows\System\LZRnTtw.exe
  C:\Windows\System\LZRnTtw.exe
  2⤵
  PID:9364
- C:\Windows\System\kHKOIVN.exe
  C:\Windows\System\kHKOIVN.exe
  2⤵
  PID:9380
- C:\Windows\System\jWyAMjO.exe
  C:\Windows\System\jWyAMjO.exe
  2⤵
  PID:9396
- C:\Windows\System\TNIVlls.exe
  C:\Windows\System\TNIVlls.exe
  2⤵
  PID:9412
- C:\Windows\System\xswhNkf.exe
  C:\Windows\System\xswhNkf.exe
  2⤵
  PID:9436
- C:\Windows\System\kAMuPIp.exe
  C:\Windows\System\kAMuPIp.exe
  2⤵
  PID:9452
- C:\Windows\System\goRuiXe.exe
  C:\Windows\System\goRuiXe.exe
  2⤵
  PID:9468
- C:\Windows\System\zshTwJm.exe
  C:\Windows\System\zshTwJm.exe
  2⤵
  PID:9484
- C:\Windows\System\wGdobZa.exe
  C:\Windows\System\wGdobZa.exe
  2⤵
  PID:9504
- C:\Windows\System\OZqiHPd.exe
  C:\Windows\System\OZqiHPd.exe
  2⤵
  PID:9520
- C:\Windows\System\LNwYpfU.exe
  C:\Windows\System\LNwYpfU.exe
  2⤵
  PID:9536
- C:\Windows\System\bbVhrvy.exe
  C:\Windows\System\bbVhrvy.exe
  2⤵
  PID:9556
- C:\Windows\System\cWCialH.exe
  C:\Windows\System\cWCialH.exe
  2⤵
  PID:9576
- C:\Windows\System\TWGQTAf.exe
  C:\Windows\System\TWGQTAf.exe
  2⤵
  PID:9596
- C:\Windows\System\XWXiwQP.exe
  C:\Windows\System\XWXiwQP.exe
  2⤵
  PID:9612
- C:\Windows\System\LpCuAPc.exe
  C:\Windows\System\LpCuAPc.exe
  2⤵
  PID:9628
- C:\Windows\System\ymTDvZA.exe
  C:\Windows\System\ymTDvZA.exe
  2⤵
  PID:9644
- C:\Windows\System\vFPWDdK.exe
  C:\Windows\System\vFPWDdK.exe
  2⤵
  PID:9660
- C:\Windows\System\rQQJkkE.exe
  C:\Windows\System\rQQJkkE.exe
  2⤵
  PID:9676
- C:\Windows\System\QlpblDn.exe
  C:\Windows\System\QlpblDn.exe
  2⤵
  PID:9700
- C:\Windows\System\xGUwiJJ.exe
  C:\Windows\System\xGUwiJJ.exe
  2⤵
  PID:9716
- C:\Windows\System\mIdrotQ.exe
  C:\Windows\System\mIdrotQ.exe
  2⤵
  PID:9732
- C:\Windows\System\TnUBmKM.exe
  C:\Windows\System\TnUBmKM.exe
  2⤵
  PID:9748
- C:\Windows\System\KmrOeTJ.exe
  C:\Windows\System\KmrOeTJ.exe
  2⤵
  PID:9764
- C:\Windows\System\csDHoEI.exe
  C:\Windows\System\csDHoEI.exe
  2⤵
  PID:9784
- C:\Windows\System\zQrviYK.exe
  C:\Windows\System\zQrviYK.exe
  2⤵
  PID:9800
- C:\Windows\System\BZCnvoi.exe
  C:\Windows\System\BZCnvoi.exe
  2⤵
  PID:9816
- C:\Windows\System\dpUaBNq.exe
  C:\Windows\System\dpUaBNq.exe
  2⤵
  PID:9832
- C:\Windows\System\UwMScIO.exe
  C:\Windows\System\UwMScIO.exe
  2⤵
  PID:9848
- C:\Windows\System\ayouqmV.exe
  C:\Windows\System\ayouqmV.exe
  2⤵
  PID:9864
- C:\Windows\System\szYGXdd.exe
  C:\Windows\System\szYGXdd.exe
  2⤵
  PID:9880
- C:\Windows\System\YKffCun.exe
  C:\Windows\System\YKffCun.exe
  2⤵
  PID:9896
- C:\Windows\System\RnpJfzn.exe
  C:\Windows\System\RnpJfzn.exe
  2⤵
  PID:9932
- C:\Windows\System\tzSKgtr.exe
  C:\Windows\System\tzSKgtr.exe
  2⤵
  PID:9948
- C:\Windows\System\IAzECUL.exe
  C:\Windows\System\IAzECUL.exe
  2⤵
  PID:9964
- C:\Windows\System\oiTIXBv.exe
  C:\Windows\System\oiTIXBv.exe
  2⤵
  PID:9980
- C:\Windows\System\kxXxJbm.exe
  C:\Windows\System\kxXxJbm.exe
  2⤵
  PID:9996
- C:\Windows\System\fuyHVIQ.exe
  C:\Windows\System\fuyHVIQ.exe
  2⤵
  PID:10012
- C:\Windows\System\QRFyJcw.exe
  C:\Windows\System\QRFyJcw.exe
  2⤵
  PID:10028
- C:\Windows\System\jvCgtfW.exe
  C:\Windows\System\jvCgtfW.exe
  2⤵
  PID:10044
- C:\Windows\System\SCWSzMW.exe
  C:\Windows\System\SCWSzMW.exe
  2⤵
  PID:10060
- C:\Windows\System\aZuWrRB.exe
  C:\Windows\System\aZuWrRB.exe
  2⤵
  PID:10076
- C:\Windows\System\nqslQgt.exe
  C:\Windows\System\nqslQgt.exe
  2⤵
  PID:10092
- C:\Windows\System\kQellYV.exe
  C:\Windows\System\kQellYV.exe
  2⤵
  PID:10108
- C:\Windows\System\MSbLrRh.exe
  C:\Windows\System\MSbLrRh.exe
  2⤵
  PID:10124
- C:\Windows\System\UsrynBu.exe
  C:\Windows\System\UsrynBu.exe
  2⤵
  PID:10140
- C:\Windows\System\PgXyoDD.exe
  C:\Windows\System\PgXyoDD.exe
  2⤵
  PID:10156
- C:\Windows\System\wqlKYXR.exe
  C:\Windows\System\wqlKYXR.exe
  2⤵
  PID:10172
- C:\Windows\System\NlXfGvj.exe
  C:\Windows\System\NlXfGvj.exe
  2⤵
  PID:10188
- C:\Windows\System\EGNJnzp.exe
  C:\Windows\System\EGNJnzp.exe
  2⤵
  PID:10204
- C:\Windows\System\fiXhFVc.exe
  C:\Windows\System\fiXhFVc.exe
  2⤵
  PID:10220
- C:\Windows\System\DdMPJhG.exe
  C:\Windows\System\DdMPJhG.exe
  2⤵
  PID:10236
- C:\Windows\System\trTdosK.exe
  C:\Windows\System\trTdosK.exe
  2⤵
  PID:8588
- C:\Windows\System\bssRyrE.exe
  C:\Windows\System\bssRyrE.exe
  2⤵
  PID:9260
- C:\Windows\System\JBIYhZd.exe
  C:\Windows\System\JBIYhZd.exe
  2⤵
  PID:9060
- C:\Windows\System\yabUfmb.exe
  C:\Windows\System\yabUfmb.exe
  2⤵
  PID:9356
- C:\Windows\System\lhnxvEG.exe
  C:\Windows\System\lhnxvEG.exe
  2⤵
  PID:9392
- C:\Windows\System\NoaxJnZ.exe
  C:\Windows\System\NoaxJnZ.exe
  2⤵
  PID:7288
- C:\Windows\System\ZhCDyQJ.exe
  C:\Windows\System\ZhCDyQJ.exe
  2⤵
  PID:9464
- C:\Windows\System\lPZVDnO.exe
  C:\Windows\System\lPZVDnO.exe
  2⤵
  PID:9248
- C:\Windows\System\JysarCH.exe
  C:\Windows\System\JysarCH.exe
  2⤵
  PID:8892
- C:\Windows\System\NjurwHI.exe
  C:\Windows\System\NjurwHI.exe
  2⤵
  PID:8844
- C:\Windows\System\ZWjBsOa.exe
  C:\Windows\System\ZWjBsOa.exe
  2⤵
  PID:9404
- C:\Windows\System\HpcwxEW.exe
  C:\Windows\System\HpcwxEW.exe
  2⤵
  PID:9476
- C:\Windows\System\zSmcvhN.exe
  C:\Windows\System\zSmcvhN.exe
  2⤵
  PID:9492
- C:\Windows\System\JrNfErP.exe
  C:\Windows\System\JrNfErP.exe
  2⤵
  PID:9528
- C:\Windows\System\szSWEoZ.exe
  C:\Windows\System\szSWEoZ.exe
  2⤵
  PID:9568
- C:\Windows\System\GaWFLDK.exe
  C:\Windows\System\GaWFLDK.exe
  2⤵
  PID:9604
- C:\Windows\System\BRMkhFI.exe
  C:\Windows\System\BRMkhFI.exe
  2⤵
  PID:9668
- C:\Windows\System\IDeSBIR.exe
  C:\Windows\System\IDeSBIR.exe
  2⤵
  PID:9592
- C:\Windows\System\ROndLpF.exe
  C:\Windows\System\ROndLpF.exe
  2⤵
  PID:9652
- C:\Windows\System\kGDgpxV.exe
  C:\Windows\System\kGDgpxV.exe
  2⤵
  PID:9688
- C:\Windows\System\EusuhAN.exe
  C:\Windows\System\EusuhAN.exe
  2⤵
  PID:9740
- C:\Windows\System\VRTmnwO.exe
  C:\Windows\System\VRTmnwO.exe
  2⤵
  PID:9780
- C:\Windows\System\yegwQgf.exe
  C:\Windows\System\yegwQgf.exe
  2⤵
  PID:9728
- C:\Windows\System\bvkQQEl.exe
  C:\Windows\System\bvkQQEl.exe
  2⤵
  PID:9796
- C:\Windows\System\EhZugnH.exe
  C:\Windows\System\EhZugnH.exe
  2⤵
  PID:9872
- C:\Windows\System\skuNbwd.exe
  C:\Windows\System\skuNbwd.exe
  2⤵
  PID:9888
- C:\Windows\System\BNGxYPv.exe
  C:\Windows\System\BNGxYPv.exe
  2⤵
  PID:9912
- C:\Windows\System\KUUGLIm.exe
  C:\Windows\System\KUUGLIm.exe
  2⤵
  PID:10024
- C:\Windows\System\HvLYDVU.exe
  C:\Windows\System\HvLYDVU.exe
  2⤵
  PID:10132
- C:\Windows\System\tVYqXnh.exe
  C:\Windows\System\tVYqXnh.exe
  2⤵
  PID:10200
- C:\Windows\System\WrLdBXS.exe
  C:\Windows\System\WrLdBXS.exe
  2⤵
  PID:9328
- C:\Windows\System\ptdOrUa.exe
  C:\Windows\System\ptdOrUa.exe
  2⤵
  PID:9232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ADbkPad.exe

Filesize
1.9MB

MD5
c96ed12b6fddc9f84159c3a7977f1986

SHA1
622f4f92d499c63b4037de4a46f9a714483b3833

SHA256
e53541ed6210aec64935e0e5cfecab9be5ca393bba0ad24f99231fd8c334392f

SHA512
ce67c430814879409e65196769d0337befacc4fca5360723e31393eb5fb7c7df05c9c4df5f374eda3ae927387bc1fc1eaa815b7fcacd221cf0690be517d20bff

Download Submit
C:\Windows\system\BJZIpOu.exe

Filesize
1.9MB

MD5
9ef75324cbd4dbe7b75a75492a1ea67d

SHA1
0959fdb560708666d3e28b2b482fcae3c44a4cb6

SHA256
b92922884705bb27505d5705c480cc4f7bed7f007d9d70aa4c0f6a8bba6fedc3

SHA512
5238173de9b71d41ce15c7ba2e652b65b7172b3f1b5d78f5685c434ccd6d7a5d0bb70240e0cda1101acb35233f728e6e437bad817b604660e8584b54388d56b0

Download Submit
C:\Windows\system\CQefmdg.exe

Filesize
1.9MB

MD5
db275810a4f91f5c416a4a73cfa952c0

SHA1
f968c8f6134bf9454ba8160d6d232d75652f7095

SHA256
c231e7eb416e8bfdab77b11a0da2a75cf95b099add7e1952cd3a13e575496873

SHA512
2505432b79dd0eefc08db776f68cbace040d4ddda18c9dc96a1dd8a0ff356becc546263b1bfa34c5ddca0db352e7fa3e160fe7944b60a5bf66cdd4ca30267037

Download Submit
C:\Windows\system\FyfXyNd.exe

Filesize
1.9MB

MD5
22a0cd2d04d9065e9fadd1e023c9e874

SHA1
b0a5c17fb950c400810f2382f7cbd513140c859f

SHA256
7da7c7647d5217c1639f822aac87f1b1d349e0eb68b8b04cd8e2d549c594ea1c

SHA512
5bef77777e64d9223c812638fa48b568e9f8da95ea66bb5cc50f9d3ab27936ca5ba388041aaa5f5b7c2a409b476fa63585c20fe85803b662dd9b21ce391bb77e

Download Submit
C:\Windows\system\GDDMaKm.exe

Filesize
1.9MB

MD5
5290ddf234f930525c797f86812f6735

SHA1
bbc32ef4c6adc174dc32e00583d9a1d582ff1295

SHA256
806b8ffdf3316cb0490ad5f77d989b4d90c2db8f39082df1b515ede11a0490e8

SHA512
81278462eaf7dc70f6344b95ca0426e5e664a398da1f717735f485a88923d6ac4eaf0635b5f707238ad3f2c950fdd052362389ae28e4e69e0754cdaf3c635c20

Download Submit
C:\Windows\system\HGdPMhQ.exe

Filesize
1.9MB

MD5
b0b145fb7e1ca80c9261955d497b00ab

SHA1
775da7c79e15cf1d0113b318702686df125f86d0

SHA256
7c6950c2a89dce3209b64d7b326fa2f0dc53c11c714017552769575bb2bcb2f6

SHA512
69d67c23e750fabf7018485bfa2b4318178054b8d1ac66390603b01339a1724e718d3c51cb22fb4f1b75eb4e7df1fb26455dc370f2c3ab716ce84f0dd64ca628

Download Submit
C:\Windows\system\QNkTtkP.exe

Filesize
1.9MB

MD5
1e0ac21470e8b91b0404f3da99acbe84

SHA1
176be3f005a5f5a7623c53ae9837d63f0f977864

SHA256
333210cbd6e1a4108ba2e156a2a15a9d562fd18efb777fa8042e50f83fe16a84

SHA512
de77627f09e15679e4c74e2863a2a220b954d0f3b0080ff18252e0b317a187b7664c30c960753aff04d1e6322f6cc5c336b3066e667f32277952503780107a28

Download Submit
C:\Windows\system\UfCooEf.exe

Filesize
1.9MB

MD5
67a7e1370d71bcff5bc3b5bfe30c93c8

SHA1
f278b0b142810bb8c5e162bcb2b1be8282e72ebd

SHA256
ab25f5272673b05cfaa94f5a394b5722ec2b67a7bb086d802f48d71bc399b05c

SHA512
acb9d49d50b350c791fff8a5386befb923bf6dfd642cb1c48c0e3a299b10092624eed87d4ecda09ba98e644f53c42f5f013106a5550107630206d032251b0296

Download Submit
C:\Windows\system\ZrpJSfh.exe

Filesize
1.9MB

MD5
78d9eeedc38902e9ebe1d9424ebdf9ea

SHA1
5b891edaf20bd8bdc70c2400a66fe139400d6352

SHA256
b7bfccda36e09b1afd695afc015fc24a72a09c7f88f4cf103c96799b08f12ef1

SHA512
4cc179747b4c790a2f51caa1b140bcda888149e54a9517bb45798e59b052f64894f37bd18ae1eec7d9479ad57cad19526df32583fc49fe226fd0dbdca6eef607

Download Submit
C:\Windows\system\cKSfjXv.exe

Filesize
1.9MB

MD5
2ad7bbdbb5ed1a282a9068ab77e7a644

SHA1
396b5e72f2aec75616cc517e852465a45cf1655c

SHA256
ce1f3560fae6fd2da5e72153737b4718a0f12e31d4f3ae9c88ddae1f46b74438

SHA512
fd50e93d90bdea05e8b9267d7824bbc5b1318a4cbbfe83b1d5dfcff39a9a5348b4ca89a5daf3a8d1ed9ec4c9318d00c8894157810fe4c736d007e2b9966a5642

Download Submit
C:\Windows\system\cXqCfen.exe

Filesize
1.9MB

MD5
44f4107d68e8024b84177fa2e83dfdcb

SHA1
bd3823aaf276ba2b7f898d21c87652d0feb6db5b

SHA256
3eb9f4335cc1ca88ca08c7c172ae3b0b83d6fed29e22294ce1a41c28eead14f7

SHA512
cfac029316692239abc5d8e0758206a579fe40cd239c2663fe59c80a948766d009f1fc11fa94c4ab040b686934b90e974491fdc6219874cda372c7fbd469599d

Download Submit
C:\Windows\system\fnZYirS.exe

Filesize
1.9MB

MD5
a0ac9242dfc49c2fc43e480dbcfb9f95

SHA1
7830d9f18f48fb44e8b4d99cf71a936ef87428b5

SHA256
47233a5599631b725f2c9652b4bf2ac08a7c190bd39e5d547df08d0d4d6154ef

SHA512
27dc90e25de48d89de4e5592785c1419f33ef4e9556b6f4223336b12bb291adb15d5eb2919799951d80e8fe54048d6c445a13c5ab06a6f2737eb2df17768bf5f

Download Submit
C:\Windows\system\iLINWHr.exe

Filesize
1.9MB

MD5
146f0816c131c8697a383b81323f7e22

SHA1
c59a63f4909f7c17ca9c5dd9f933b4409e94233f

SHA256
ca7a9e42d79b6dfe220ead48d9328a592881f02b03f56b5029f4e7bdff68874d

SHA512
c53c2ab2ce74dee61eb5b4041ce37d50bf56c035d9a0b3a115477d5796944738de590257322a9bec91c91c79c2fea01ae75dc7dd28a6c17f5ec4ea0c3a2c1296

Download Submit
C:\Windows\system\ldVLCIO.exe

Filesize
1.9MB

MD5
bd0b80dc67661a593febed0d05a43c7f

SHA1
2d3f449988a43bf9e1c8cd4162ab22899aceb0ec

SHA256
829f537d4e2c68bdcd4ea75d8f8cbcb17505725f6c70e17c72d4b01daaec0551

SHA512
d882252f453ede91ca9784d1670f9460d7b08ff842949665f8d6d1ea0e87297da7dd01757ec29fa12af62321f55581ee853b6e91bcca7004afe516fa905621c2

Download Submit
C:\Windows\system\loEnqPA.exe

Filesize
1.9MB

MD5
ac9c185af1526ccb824f98fdf45e83f0

SHA1
37f70c97cb254aa7db70e14e209301e239014743

SHA256
374dd738fb0d14513df2648a62beeeab570a4771d7f93b558be2d89f076b7665

SHA512
acabb21c5d32535642e025d0318fbdab9fb7d1d1eb322206c6902c3fb9d8fb8ad9ce25308e17bdc5b7d6a5bb2ee34bf76006dec94f7f13534378dbf2baf3baee

Download Submit
C:\Windows\system\mJsMmau.exe

Filesize
1.9MB

MD5
12de08767082dd9ac5bb559e86010283

SHA1
39e977fcd752b815de5d01fc7f83839474fc8a13

SHA256
bdb7eb4af1e50c37435bdd5fcabfeec61faa7a82bcb5160095026e573005e78b

SHA512
46d5b25df287f4f1177b5e2f93007aacbd06e3f8fdc829980a920bdcab3a44f002b29b0fc41d61343a03e6cd772e1d92f9a9c8a43c8476a8ef61ac2ac1db907b

Download Submit
C:\Windows\system\muTaNxm.exe

Filesize
1.9MB

MD5
d691d2acc20fd7e33a57b4c4390350de

SHA1
108808b34705a24be649773d68858b88a9d0df8c

SHA256
2d261b3f86157572fb2e128d8c44fb48a28bfbfa0f21ad39cb9780fb768730c2

SHA512
238f61a8507278ff6686667a4c8ed103e659753f6dae2a1d8e377e5d8e04592931efe2792e90cf611803b957d674184999127f3b7f52935d2c04f4a79037f697

Download Submit
C:\Windows\system\rZjyYCd.exe

Filesize
1.9MB

MD5
1daf8c93eb3cb8b9842954fc453b9c27

SHA1
ae93200aed3f2242700b55fc5ecda8726dde9e85

SHA256
a148d5714997f9955ec3818a352005687babac182d122c785993305fcf662293

SHA512
43d4123ea70fa5b430c51db59227a22f786a464798c9d1b50ffb617a1a875cca9670552b38c18097f51d2eac4203747c87ca7196a71e36f01e1f3fbc13a3ee93

Download Submit
C:\Windows\system\rodbaFl.exe

Filesize
1.9MB

MD5
3985881fa7df5b400b7e6c4620099e1f

SHA1
5ad257f8af08f40e87beebdee49498150b668a16

SHA256
5a982c824d345b0447381ba92f06888d7555ae7c27c3ac9fb97d5dd7b703d16b

SHA512
87bdd10bc87de746be52265bf6864405bd455be13ad8c44ff873f21602c92690eefdfec6751a690383b409153de43bc4f14acb03610baccd5b3c99e08f012681

Download Submit
C:\Windows\system\ryHKTiJ.exe

Filesize
1.9MB

MD5
6fac4933901826e9393439adb3d28070

SHA1
6b80b53138c5c097ced2e70b671ebee24df7a93f

SHA256
909437e49ea0369d76c17701a65643fdef0df247e7a04a7a0002a059fe24ebec

SHA512
35e9f3aacc99b8795b554bf12c630d04c5bfa5d06a59833f3ef20bf4aacead067461ea4558680033ec946853146e93435c572385538dc5b7d12565cdff219f2e

Download Submit
C:\Windows\system\udJsahr.exe

Filesize
1.9MB

MD5
242205b4ed1ae9f618b6d8371acd701e

SHA1
77800eb5f671857d854f9aef1e0a82714356fda9

SHA256
8c9fdfa5ac13413840af3b54cc62c29d4a7186008de7e2bc6e788c9e572f09cf

SHA512
0555defe7c2e5504c7947434c5115be2b0eb5726d0a365dcfeae7019625cceae7ad148807f92823be49f31e206ea65ef4d99fd6e707dfa8233860b69bd2036e3

Download Submit
C:\Windows\system\uzJZocr.exe

Filesize
1.9MB

MD5
4b21f55178dcb3cf8dd598f69e44ab9b

SHA1
23e4bf9da53488f96c3b19b95b02218454466c99

SHA256
13bbf4e27f1b95f2ce537e57210ba2679e48dc794c92e9974b19d7d73a432cf6

SHA512
84e2cca3ed7a5d3441e7ad86dd69767f6a35f116fb660bdd98423a19c516a00c7b3b94c40c3f5ee7246ab2720bf2ff19fb2c8067ba33db925f454072d2d2c078

Download Submit
\Windows\system\DGencBX.exe

Filesize
1.9MB

MD5
7e929d9ac2eaddb621745de02ccaa5cb

SHA1
ec1dfb64810cbf87ffcbca3697ccab8570f7bd08

SHA256
81bcb0d778bbc13c9f23141b044834caa103b6667ca48006ff2e331edcaed0f4

SHA512
cdaa70694f6870269a0b5e92d78e97d7db1c0fc793129d2a4206de462055a5dd9e1eeb270199a21be21d5b20a64f214d4b39cae642090f63b2a99e622a321016

Download Submit
\Windows\system\DIBKqQJ.exe

Filesize
1.9MB

MD5
f7ad141070bb451eb74056a19a81e853

SHA1
520a31ca541bf0ea3a63c8d8ed9d87759cd5a320

SHA256
982a78e43e7a69370460a6c2a925e3c23f163d8f7a7391e486654766e55f9e5c

SHA512
d52ddbd562597b23b194529887731ebd05d6e1a226f08d91d0d5689361bcefbcaeec59399171f1d2594000f6a89a8762fe1d272b08202758c86aadf0e4a27d66

Download Submit
\Windows\system\HsuwOUE.exe

Filesize
1.9MB

MD5
7f758c5abc6520a0af6461acff7ceafc

SHA1
1428c9d5303d064a46424a478b15be5b0ccbe87c

SHA256
f96e4a8b049ffc288c7e66edec4a0a783e0675971480c9c2ea7b14ad7798250b

SHA512
8c9b3389611407906dadf9d51065817cbcfb3a9e6f969cfc1f34ae408bf6aa280ba6e8e092e010ba1dde31f9c534694cd5613896dd7d0eb6713b9cbfd46a28c5

Download Submit
\Windows\system\IBYeLIS.exe

Filesize
1.9MB

MD5
9460bf7aa5914ee769342cdb703f1b88

SHA1
555398d4b5aa09a4e12c3938847efda14d485fe2

SHA256
adb28db5fa34d5f752e3ef202bff904f0f4530a056f2c06f117669035167d203

SHA512
c68e0af7b7e3fc8c63c9967bba6fe177ae6bc2d174a81616992fed79cf64fce7e1ff0188f4418d08a60a94139c40cd27a75c02a488fe642a5b6001f2b7ef546d

Download Submit
\Windows\system\IMhJtNq.exe

Filesize
1.9MB

MD5
15509bd486ae60253097632bed5d0976

SHA1
45b19e5c04afb97b95fb5116cd1dcaf301cd0ecb

SHA256
20d07435e0c815b4dc94b70af324338123a2db3069f9b6c2d60a28dfcc30c9f9

SHA512
348152231879b6eb2472c5ab1d28edbeb268d143aed725b450f84bbf58b839f2caa1960ccf4c121b0a043aad40c79d03c0065d0b3dea9f9ce5aa9c1e69c1f6bc

Download Submit
\Windows\system\Jugpvww.exe

Filesize
1.9MB

MD5
3f1168fc92cea1ee2dc47143e0757e78

SHA1
197c54b2076908a185d06d64dbd0cd3b90601d0f

SHA256
6b78be1d4b707df0c9555a4ddf704ee747b2c6bc8e2afe652bfa360fe4ac7f0c

SHA512
c1ee066e382e392ee2b63ad5e3168d8cdecc30fa4aefb54899dd33766de726d9bb16bcf6b5fef791e6c2d3caf3e189e5d85d8aaf47c59bcb49a1b67bb9e8e9e8

Download Submit
\Windows\system\MPOBOhC.exe

Filesize
1.9MB

MD5
33c2219e404034dac4518d70df637a58

SHA1
3916cda5dfd15795f139e75ce359aad53ab9c5fb

SHA256
82009d00634e779abf33975a99d94e624158bb0175d82f5a311c82e6e88be484

SHA512
0c0880c316fbf2b2880b0186d51377e5bb99e4c3b0c4104a9a33b24e86618157a7da6fade26ffd360175a36c9152963f18e9741231e34006279c8ea99d4db347

Download Submit
\Windows\system\NSWCyEW.exe

Filesize
1.9MB

MD5
2ec98e74171a78f5a99a06daddd55e1c

SHA1
2022c631ae8280ca38a3e958a6ba493cac363522

SHA256
f2949947c9972582e18a9d794f74c2c7ebf0201bec1f9c79491cd0fdcee9c202

SHA512
6df2899bc3c8472b8a5de2ba4abcd8a8e1aeb3f768cd9c0eccebd08014773917118e361277d6eb513eb42de7847c96f56ca5bdb42567bd23b230644e34014ae9

Download Submit
\Windows\system\PAgFoXV.exe

Filesize
1.9MB

MD5
e952c6dc2767c62ba0052eda40a37db0

SHA1
29f8767a504951e3ff5b0c8d33260a0223ec683b

SHA256
23fd8a61fa826eb914b7df468cb6e8cb285dce874d4b88bd6b5f275b4705c965

SHA512
47d37b62b1a34e597484e98c0aa8ab124514e8fc0d44bccd36652da318e2cc21268e99444036c0de945fe6c8d207dcf26523da2c19f13d8751909a44ef2be55e

Download Submit
\Windows\system\PmbeswS.exe

Filesize
1.9MB

MD5
d6cdcefb65686d9c1921b485aeb969ab

SHA1
64e2fbef3d5312865df6408309479ea15ff1e511

SHA256
fb93a3e11ddd38d926dfae81ca01dbed6b7db46ab32488f80c2125d77157bed4

SHA512
a9c35325c58344c3232744c2e01b93aa4526f029d4fa0b3d397b495998f2fd64e3baa1bec4b9c068089862eb6e9c63e9742c1f815f208ad60cfc843e2d752f27

Download Submit
\Windows\system\RapuuSk.exe

Filesize
1.9MB

MD5
a35c64262ac7476f0f9a64e31043aa42

SHA1
08effa925a986ac8efea98ac6fd0791c32e2c774

SHA256
de9e4dd0742a5fb154e81a18de581df3de6694428bbbf662eb57dfa7bc4544cb

SHA512
b957eb816cd80f5a89a09659849f9541965ab3ee02079af6bf3da65c94bddb1dd6e4994724e180725dd1723f3499e17fc27a45742c7684805ad2ca28a5f529f8

Download Submit
\Windows\system\aFnQumF.exe

Filesize
1.9MB

MD5
375a36aad7705aa9a7323a5fa9c1794e

SHA1
008b070dc442f888b9262e958baccf90c74417f3

SHA256
1c432206e9c23884cb21441663c5011fc892260764517782c5f87c91e18af6d9

SHA512
22fd11ef8d99f47457f4d178e9528958b6e9b5c50eb375d9be3f0874ed8a30ef2a32f34ad031c7052c0cb7d9ff075329f710c3e035bee940130a89810927c248

Download Submit
\Windows\system\bbNzhTk.exe

Filesize
1.9MB

MD5
a0ca74fc8b8e1a45f245b217b75f9d25

SHA1
fe55cac7daa25989ff9341853e11033a37f4881e

SHA256
41a998b5c89daeffbd4016263b62852007e06b5af619b252efb8e7c8f209a5ed

SHA512
65e785ef85836027e8f38b9e3c612869e34a0b2f75e56b5ac391a22a89a483894fa6db2480f18cae9cbcfe109d27295f5ed416d88d9a6bf5833c5ee15cca4478

Download Submit
\Windows\system\ceGFtYS.exe

Filesize
1.9MB

MD5
56aee255917ffff3f7bf898c255f99ef

SHA1
819489056741ba2ae86f616b5cb38b17066066bc

SHA256
2c041223d32103f2d3ac2724619bb7878de1436cc8d4d66b261555e2c77c047a

SHA512
be284f77ff02208e2a449d3b064006a188b47aa5c855f6cfaee9eb5232f7dc59024ec91cb74cdca4b405d94d6bbd9e62b622e41b3e0851fbb5528ea45f3f9a67

Download Submit
\Windows\system\eqQmMWa.exe

Filesize
1.9MB

MD5
e07f8d3aac0736048f7eb4d690b83599

SHA1
760a5ddcbf6b179f572e1628073b18a6eefb9bc5

SHA256
7f9e8805ce9db0bd64a63919e4afb7522104133218bd82af56c7ce01c4ebebcb

SHA512
672ac14725ecc8f48635ab3659b0d4a12bf5d857295592b5b4a988e89699fb3e52c476ace6eb403da14c798242c496c6903d57615a6b2b75c3003b189ba07651

Download Submit
\Windows\system\ldeaVKt.exe

Filesize
1.9MB

MD5
979246bf453c2fc8faf04caa90744677

SHA1
c8202da3cb1586ddb0fb7f87447491b2af83b444

SHA256
e2e8b216ecfcd564d823aa675888776d90d176964c9ae1cea1a13529c62b05be

SHA512
8b468696e6071ed34ce5ab08f72f7958a149ca69ffd36755c584edab76e39bff5299894dfcbf43a052620e690a704a3311e88c2ced8ba85f0c2b60f9a195a64f

Download Submit
\Windows\system\yYNSbIg.exe

Filesize
1.9MB

MD5
4d9b0707b7fefb2b39937b336655ba08

SHA1
683f84f392f492ddfa4aab92eed1a1d25dee25fd

SHA256
eaed9c7af5a2af926110ac216bce65e87b68ae745e6f667bf163bfb691de2717

SHA512
6042069d9a56f9ac914725eda130624dfad17115b7696b6a6de4ad8b0fbc6d58628daeb76c7041990788721bdcfdef398955de48f1803fb7f24ca956638bef32

Download Submit
memory/2364-35-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2452-62-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2456-39-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2532-48-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-74-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-36-0x0000000002DA0000-0x0000000002E20000-memory.dmp

Filesize
512KB

Download
memory/2604-43-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-33-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-501-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-21-0x0000000002DA0000-0x0000000002E20000-memory.dmp

Filesize
512KB

Download
memory/2604-26-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2604-27-0x0000000001F30000-0x0000000001F38000-memory.dmp

Filesize
32KB

Download
memory/2604-34-0x0000000002DA0000-0x0000000002E20000-memory.dmp

Filesize
512KB

Download
memory/2640-1109-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-18-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-80-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2880-77-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/3020-431-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/3020-12-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/3068-73-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/3068-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/3068-7-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-46-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/3068-45-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-20-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-38-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/3068-71-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/3068-75-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-58-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/3068-63-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/3068-613-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/3068-1-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download